Endpoint with Location 'https://FQDN/path/Shibboleth.sso/...' discarded because neither its Location nor ResponseLocation match ACS URL 'https://FQDN/Shibboleth.sso/...'

[Stefan König]

Hello,

I currently try to setup a test environment using shibboleth, whereas 
the URIs of the IDP and SP are:
IDP: https://idefix.worldtalk.de/idp/
SP: https://idefix.worldtalk.de/sp/

I already found some hints in the archive of this mailing list, but I 
still got stuck with the error "*Error Message: No peer endpoint 
available to which to send SAML response";

*What happens is:
* https://idefix.worldtalk.de/sp/ is redirected to the login page of the IdP
* After Login credentials are entered I get the above error from the IdP

Credential Check seems ok, according to idp-processing logs. But it 
seems the IdP or SP-Configuration is wrong in a way that it isn't able 
to send the reply back to the SP.
I already figured out, that there is a problem with the 
"samlp:AuthRequest"-Message, which I assume to be sent by the SP (unsure).
It contains the parameter 
AssertionConsumerServiceURL="https://idefix.worldtalk.de/Shibboleth.sso/SAML2/POST" 
which seems to be wrong (should be /sp/Shibboleth.sso not 
/Shibboleth.sso). This seems to cause the later problem with //// 
Endpoint with Location 
'https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST' discarded 
because neither its Location nor ResponseLocation match ACS URL 
'https://idefix.worldtalk.de/Shibboleth.sso/SAML2/POST' ////. And in the 
end the Error message regarding the peer endpoint, right?

I need to know where I must change a "https://idefix.worldtalk.de" to 
"https://idefix.worldtalk.de/sp/"; I looked in the config files for it 
but didn't find it...

Question: Which configuration file needs adaption? Which 
line/tag/parameter is probably the root of the problem?

Thank's a lot.

Stefan


idp-processing.log:
========= CUT HERE ============
18:14:15.474 - DEBUG [PROTOCOL_MESSAGE:113] -
<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest 
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
AssertionConsumerServiceURL="https://idefix.worldtalk.de/Shibboleth.sso/SAML2/POST" 
Destination="https://idefix.worldtalk.de/idp/profile/SAML2/Redirect/SSO" 
ID="_0977a67e9eda780008cca9442eec441c" 
IssueInstant="2012-02-17T17:14:15Z" 
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Version="2.0">
<saml:Issuer 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idefix.worldtalk.de/idp/shibboleth</saml:Issuer>
<samlp:NameIDPolicy AllowCreate="1"/>
</samlp:AuthnRequest>

[....]
18:14:20.653 - DEBUG 
[org.opensaml.saml2.binding.AuthnResponseEndpointSelector:69] - 
Selecting endpoint by ACS URL 
'https://idefix.worldtalk.de/Shibboleth.sso/SAML2/POST' and protocol 
binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' for request 
'_0977a67e9eda780008cca9442eec441c' from entity 
'https://idefix.worldtalk.de/idp/shibboleth'

18:14:20.653 - DEBUG 
[org.opensaml.saml2.binding.AuthnResponseEndpointSelector:202] - 
Endpoint with Location 
'https://idefix.worldtalk.de/sp/Shibboleth.sso/SAML2/POST' discarded 
because neither its Location nor ResponseLocation match ACS URL 
'https://idefix.worldtalk.de/Shibboleth.sso/SAML2/POST'

[....]

18:14:20.654 - WARN 
[org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying 
party 'https://idefix.worldtalk.de/idp/shibboleth' requested the 
response to be returned to endpoint with ACS URL 
'https://idefix.worldtalk.de/Shibboleth.sso/SAML2/POST'  and binding 
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, 
with that URL and using a supported binding,  can be found in the 
relying party's metadata
18:14:20.654 - ERROR 
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] 
- No return endpoint available for relying party 
https://idefix.worldtalk.de/idp/shibboleth
18:14:20.659 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:344] - 
No login context in storage service
18:14:20.660 - DEBUG 
[edu.internet2.middleware.shibboleth.idp.ui.ServiceContactTag:177] - No 
relying party, nothing to display
========= CUT HERE ============
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120217/d6228c0f/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4467 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20120217/d6228c0f/attachment.bin