...
5) A validates G via trusting G' (G' - CA cert - is in IdP's meta file, IQ-meta.xml in case of me)
7. Before running ShibEchoService, Configure in the shibboleth-id side (shadow120.punch.purdue.edu)
...
$ gridshib-saml-issuer --user user1 --outfile /tmp/x509up_u1000 --authn --authnMethod urn:oasis:names:tc:SAML:1.0:am:password --address 128.210.189.246
6. Checking proxy
$openssl x509 -text -noout -in /tmp/x509up_u1000
...