Problems logging on to salesforce with shibb 2.3.5

[Chad La Joie]

Use of the Unsolicited SSO endpoint in the IdP does not populate the
InResponseTo in the assertion, so whatever you're using it's not that.

If this was working with 2.1.5, perhaps what Brent's JSP page is doing
is generating a SAML2 <AuthnRequest> on behalf of the SPs.  From the
SP's standpoint, those two scenarios would be identical but the from
the IdP they are not at all the same thing.  I'd recommend walking
down the hall and asking Brent.

On Fri, Feb 10, 2012 at 09:09, David Massie <dhm24 at georgetown.edu> wrote:
>
> We are upgrading to shibb 2.3.5 from 2.1.5. One of the vendors we are
> using (on 2.1.5) is salesforce. They use unsolicited SSO.
>
> In 2.1.5 I used a jsp page Brent Putnam wrote and it worked fine.
>
> On 2.3.5 unsolicited SSO is built in during installation.
>
> I have installed 2.3.5 and got it working with workday (which is also
> unsolicited sso). But I cant get it to work with salesforce.
>
> I used the salesforce assertion checker and it tells me that, in the
> assertion, there is an inResponseTo clause. They do not accept such a
> clause and so, the login fails.
>
> I went back to our production version (2.1.5) and looked at the
> assertion and it does NOT have the inResponseTo clause.
>
> I don't remember having to do anything in 2.1.5 to remove the clause and
> I don't see how I can remove it from assertions generated from version
> 2.3.5.
>
> Can anybody advise me on how to get it out of there?
>
> Has anyone gotten 2.3.5 to work with salesforce?
>
> --
> Thanks,
>
> Dave Massie
> x73880
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered