Configuring Shibboleth 2.x IdP with Novell Access Manager as SSO

[Chad La Joie]

Hey Sara,

The IdP gets its hostname from the container.  You didn't say but I
assume that's Tomcat.  There proxy support documentation[1] talks about
how to tell Tomcat what the "right" hostname is and what it should
return to code when it asks.  Give that a try.

[1] http://tomcat.apache.org/tomcat-6.0-doc/proxy-howto.html

On 10/31/11 2:48 PM, Sara Hopkins wrote:
> I have searched the wiki and the mailing list archives for answers to 
> this one, but I haven't found anything that appears directly relevant.
> 
> I do technical support for the UK federation, and I have two clients 
> both facing the same issue, each of whom has a Shibboleth IdP configured 
> to use Novell Access Manager as SSO. One of them is proxied through 
> Apache httpd using ajp_proxy, the other one is not. Each IdP has a set 
> of endpoints in the (UK) federation metadata of this form:
> 
> https://shib.uni.ac.uk/idp/profile/Shibboleth/SSO
> https://shib.uni.ac.uk/idp/profile/SAML2/POST/SSO
> https://shib.uni.ac.uk/idp/profile/SAML2/POST-SimpleSign/SSO
> https://shib.uni.ac.uk/idp/profile/SAML2/Redirect/SSO
> 
> https://shib1.uni.ac.uk:8443/idp/profile/SAML1/SOAP/AttributeQuery
> https://shib1.uni.ac.uk:8443/idp/profile/SAML2/SOAP/AttributeQuery
> https://shib1.uni.ac.uk:8443/idp/profile/SAML1/SOAP/ArtifactResolution
> https://shib1.uni.ac.uk:8443/idp/profile/SAML2/SOAP/ArtifactResolution
> 
> They need to be on the two different hosts, because the port 443 
> endpoints are for SSO and so they need to trigger the NAM SSO (which is 
> on yet another host), whereas the 8443 endpoints are for the "back 
> channel" communication with the SP and therefore should not trigger the 
> NAM SSO.
> 
> This works fine when using SAML1, but in SAML2 it fails with an error 
> like this:
> 
> 00:03:30.749 - ERROR 
> [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:204] - SAML 
> message intended destination endpoint 
> 'https://shib.uni.ac.uk/idp/profile/SAML2/Redirect/SSO' did not match 
> the recipient endpoint 
> 'https://shib1.uni.ac.uk/idp/profile/SAML2/Redirect/SSO'
> 
> So, it appears the IdP is rejecting this SAML message because the 
> intended destination endpoint is on the shib.uni.ac.uk host, but the IdP 
> "knows" that its hostname is shib1.uni.ac.uk. The same error occurs on 
> both IdPs (with and without Apache httpd).
> 
> My question is, then, what can be done to work around this problem, for 
> both the httpd-proxied IdP and the stand-alone IdP? I would be grateful 
> to hear from those who have actually configured this and has it working.
> 
> Thanks in advance,
> 
> Sara