Decoded message was not a SAML 1.x Response

[Cantor, Scott]

On 4/23/12 10:34 PM, "Hanan Teleb" <hanan.ebraheem at gmail.com> wrote:
>
>the SAML version used for that request is SAML1 as I have
>AssertionConsumerServiceIndex="3" for SAML1 while
>AssertionConsumerServiceIndex="1" for SAML 2. does the binding protocol
>in the response should
> match AssertionConsumerServiceIndex in the AuthnRequest. for this case
>SAML:2.0:protocol in the response should be SAML:1.0:protocol b/c
>AssertionConsumerServiceIndex=3 in the request?

Your problem could be that the indexes in your metadata do not match the
ones the SP is internally using in the configuration. This is not rare,
and is why we don't use indexes in requests to IdPs. That isn't how it
works by default. acsByIndex is now off by default, and you would have to
add that option to flip it from passing the ACS URL in the AuthnRequest by
index instead of just by full URL.

However, I will say again that your log does not show an error. It's
showing a 2.0 request and a 2.0 response, and that doesn't show any
problem that would lead to that error message. If the IdP did send a 2.0
response to the SP's 1.1 endpoint, that would cause that error.

But it seems likely that your metadata is wrong, and that's the root
problem, along with setting this option to pass the ACS by index.

If for some reason the IdP requires that, then you would need to get the
metadata indexes to match the ones the SP knows about internally. That's
not easy to do, particularly with 2.4+ SPs. But the log will show what
index it's passing in the AuthnRequest. That has to match the metadata the
IdP is using as being the index of a SAML 2.0 POST endpoint.

-- Scott