Configuring Shibboleth 2.x IdP with Novell Access Manager as SSO

[Sara Hopkins]

I have searched the wiki and the mailing list archives for answers to 
this one, but I haven't found anything that appears directly relevant.

I do technical support for the UK federation, and I have two clients 
both facing the same issue, each of whom has a Shibboleth IdP configured 
to use Novell Access Manager as SSO. One of them is proxied through 
Apache httpd using ajp_proxy, the other one is not. Each IdP has a set 
of endpoints in the (UK) federation metadata of this form:

https://shib.uni.ac.uk/idp/profile/Shibboleth/SSO
https://shib.uni.ac.uk/idp/profile/SAML2/POST/SSO
https://shib.uni.ac.uk/idp/profile/SAML2/POST-SimpleSign/SSO
https://shib.uni.ac.uk/idp/profile/SAML2/Redirect/SSO

https://shib1.uni.ac.uk:8443/idp/profile/SAML1/SOAP/AttributeQuery
https://shib1.uni.ac.uk:8443/idp/profile/SAML2/SOAP/AttributeQuery
https://shib1.uni.ac.uk:8443/idp/profile/SAML1/SOAP/ArtifactResolution
https://shib1.uni.ac.uk:8443/idp/profile/SAML2/SOAP/ArtifactResolution

They need to be on the two different hosts, because the port 443 
endpoints are for SSO and so they need to trigger the NAM SSO (which is 
on yet another host), whereas the 8443 endpoints are for the "back 
channel" communication with the SP and therefore should not trigger the 
NAM SSO.

This works fine when using SAML1, but in SAML2 it fails with an error 
like this:

00:03:30.749 - ERROR 
[org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:204] - SAML 
message intended destination endpoint 
'https://shib.uni.ac.uk/idp/profile/SAML2/Redirect/SSO' did not match 
the recipient endpoint 
'https://shib1.uni.ac.uk/idp/profile/SAML2/Redirect/SSO'

So, it appears the IdP is rejecting this SAML message because the 
intended destination endpoint is on the shib.uni.ac.uk host, but the IdP 
"knows" that its hostname is shib1.uni.ac.uk. The same error occurs on 
both IdPs (with and without Apache httpd).

My question is, then, what can be done to work around this problem, for 
both the httpd-proxied IdP and the stand-alone IdP? I would be grateful 
to hear from those who have actually configured this and has it working.

Thanks in advance,

Sara
-- 
Sara Hopkins
Support Team
UK Access Management Federation for Education and Research
web:    http://www.ukfederation.org.uk/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.