title: Spring saml sample application with https idp url throws exception: No IDP was configured, please update included metadata with at least one IDP
body: <p>How to configure spring saml sample application for adfs https idp url? 
  I could successfully run the sample application using SSOCircle. Now, I am trying to use the client's ADFS url instead and I am getting the following exception:</p>
  
  <pre><code>org.opensaml.saml2.metadata.provider.MetadataProviderException: No IDP was configured, please update included metadata with at least one IDP
      at org.springframework.security.saml.metadata.MetadataManager.getDefaultIDP(MetadataManager.java:781)
      at org.springframework.security.saml.context.SAMLContextProviderImpl.populatePeerEntityId(SAMLContextProviderImpl.java:157)
      at org.springframework.security.saml.context.SAMLContextProviderImpl.getLocalAndPeerEntity(SAMLContextProviderImpl.java:127)
      at org.springframework.security.saml.SAMLEntryPoint.commence(SAMLEntryPoint.java:146)
      at org.springframework.security.web.access.ExceptionTranslationFilter.sendStartAuthentication(ExceptionTranslationFilter.java:186)
      at org.springframework.security.web.access.ExceptionTranslationFilter.handleSpringSecurityException(ExceptionTranslationFilter.java:168)
      at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:131)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:186)
      at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:166)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:87)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
      at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
      at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
      at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:108)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:522)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
      at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349)
      at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:1110)
      at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
      at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:785)
      at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1425)
      at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      at java.lang.Thread.run(Thread.java:748)
  </code></pre>
  
  <p>I have tried the following solutions suggested in similar questions:</p>
  
  <ol>
  <li>Downloading federation metadata and hosting on localhost, changing the url to <a href="https://localhost:8080/metadata/federationmetadata.xml" rel="nofollow noreferrer">https://localhost:8080/metadata/federationmetadata.xml</a></li>
  <li>copying the certificate content from metadata.xml, creating signature.crt with that content and adding it in keystore</li>
  <li>Adding the option <code>&lt;property name="includeDiscoveryExtension" value="false"/&gt;</code></li>
  </ol>
  
  <p>The provided adfs federation metadata xml has <strong>https</strong> protocol, whereas the sample SSOCircle idp uses <strong>http</strong> protocol. Please suggest the required configuration. I am still in process of learning Spring Security SAML.</p>
  
  <p>Many Thanks</p>
  
  <p><strong>Edit:</strong>
  Please find below configuration:</p>
  
  <pre><code>  &lt;!-- Logger for SAML messages and events --&gt;
      &lt;bean id="samlLogger" class="org.springframework.security.saml.log.SAMLDefaultLogger"/&gt;
  
      &lt;!-- Central storage of cryptographic keys --&gt;
      &lt;bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager"&gt;
          &lt;constructor-arg value="classpath:security/samlKeystore.jks"/&gt;
          &lt;constructor-arg type="java.lang.String" value="nalle123"/&gt;
          &lt;constructor-arg&gt;
              &lt;map&gt;
                  &lt;entry key="apollo" value="nalle123"/&gt;
              &lt;/map&gt;
          &lt;/constructor-arg&gt;
          &lt;constructor-arg type="java.lang.String" value="apollo"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Entry point to initialize authentication, default values taken from properties file --&gt;
      &lt;bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint"&gt;
          &lt;property name="defaultProfileOptions"&gt;
              &lt;bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"&gt;
                  &lt;property name="includeScoping" value="false"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;!-- IDP Discovery Service --&gt;
      &lt;bean id="samlIDPDiscovery" class="org.springframework.security.saml.SAMLDiscovery"&gt;
          &lt;property name="idpSelectionPath" value="/WEB-INF/security/idpSelection.jsp"/&gt;
      &lt;/bean&gt;
  
      &lt;!-- Filter automatically generates default SP metadata --&gt;
      &lt;!--&lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
          &lt;constructor-arg&gt;
              &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
                  &lt;property name="entityId" value="somethingUnique"/&gt;
                  &lt;property name="includeDiscoveryExtension" value="false"/&gt;
                  &amp;lt;!&amp;ndash;&lt;property name="signMetadata" value="false"/&gt;&amp;ndash;&amp;gt;
                  &lt;property name="extendedMetadata"&gt;
                      &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                          &lt;property name="signMetadata" value="false"/&gt;
                          &lt;property name="idpDiscoveryEnabled" value="true"/&gt;
                      &lt;/bean&gt;
                  &lt;/property&gt;
              &lt;/bean&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;--&gt;
      &lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
          &lt;constructor-arg&gt;
              &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
                  &lt;property name="entityId" value="LocalHilitADFSPOC"/&gt;
                  &lt;property name="extendedMetadata"&gt;
                      &lt;bean class="org.springframework.security.saml.metadata.ExtendedMetadata"&gt;
                          &lt;property name="signMetadata" value="false"/&gt;
                          &lt;property name="idpDiscoveryEnabled" value="true"/&gt;
                      &lt;/bean&gt;
                  &lt;/property&gt;
              &lt;/bean&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
      &lt;!-- The filter is waiting for connections on URL suffixed with filterSuffix and presents SP metadata there --&gt;
      &lt;bean id="metadataDisplayFilter" class="org.springframework.security.saml.metadata.MetadataDisplayFilter"/&gt;
  
      &lt;!-- Configure HTTP Client to accept certificates from the keystore for HTTPS verification --&gt;
      &lt;!--
      &lt;bean class="org.springframework.security.saml.trust.httpclient.TLSProtocolConfigurer"&gt;
          &lt;property name="sslHostnameVerification" value="default"/&gt;
      &lt;/bean&gt;
      --&gt;
  
      &lt;!-- IDP Metadata configuration - paths to metadata of IDPs in circle of trust is here --&gt;
      &lt;bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"&gt;
          &lt;constructor-arg&gt;
              &lt;list&gt;
                  &lt;bean class="org.opensaml.saml2.metadata.provider.HTTPMetadataProvider"&gt;
                      &lt;constructor-arg&gt;
                          &lt;value type="java.lang.String"&gt;http://localhost:8080/metadata/federationmetadata.xml&lt;/value&gt;
                      &lt;/constructor-arg&gt;
                      &lt;constructor-arg&gt;
                          &lt;value type="int"&gt;5000&lt;/value&gt;
                      &lt;/constructor-arg&gt;
                      &lt;property name="parserPool" ref="parserPool"/&gt;
                  &lt;/bean&gt;
              &lt;/list&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;!-- SAML Authentication Provider responsible for validating of received SAML messages --&gt;
      &lt;bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider"&gt;
          &lt;!-- OPTIONAL property: can be used to store/load user data after login --&gt;
          &lt;!--
          &lt;property name="userDetails" ref="bean" /&gt;
          --&gt;
      &lt;/bean&gt;
  
      &lt;!-- Provider of default SAML Context --&gt;
      &lt;bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl"/&gt;
  </code></pre>