Endpoint with Location 'https://FQDN/path/Shibboleth.sso/...' discarded because neither its Location nor ResponseLocation match ACS URL 'https://FQDN/Shibboleth.sso/...'

[Stefan König]

GOT IT WORKING!

Or as my grandmother likes to say: "As soon as one does it right, it 
start's working!" (actually the german translation of that; but we won't 
be too pedantic, do we? ;-))
I'll now describe how I solved the problems, so others can just find the 
solution.

@Scott and Chad La Joie: Thank's for you help and motivation... it took 
me some weeks to figure out how to do it, but you finally pushed me in 
the right directions.

Best Regards,
Stefan



 >> ERROR:
 >> No return endpoint available for relying party

I actually had to give the IdP config the full metadata of the SP.

I did this by adding another metadata-reference (to sp-metadata.xml) in 
relying-party.xml, while keeping the rest of the file as like after 
installation. It's possible to put this metadata into idp-metadata.xml, 
but I wanted to keep the SP metadata seperated from the IDP metadata.

Putting the SP metadata inside the idp-metadata.xml is done via 
<EntitiesDescriptor> around the IdPs own <EntityDescriptor>-Tag and then 
adding the SP metadata inside the <EntitiesDescriptor>.

NOTE: My first try didn't work, as I forgot the namespace-definition 
inside <EntitiesDescriptor> (just left it in <EntityDescriptor> of the 
IdP). This resulted in an error message about "No unmarshaller 
registered for document element  EntitiesDescriptor". Suggestion: Maybe 
it's useful to give the user some hint, that he/she has possibly not 
defined the namespace correctly. The "unmarshaller"-error just sounds 
like "Software can't handle the tag, we'll implement that in future"

[Suggestion for Adaption]:

If a default namespace was defined:
 >> INFO ...... : No unmarshaller registered for document element 
<Element>. Hint: Have you specified the correct namespace?

If none was defined:
 >> INFO ...... : No unmarshaller registered for document element 
<Element>. Hint: Did you miss a namespace definition?


NEXT PROBLEM:
 >> ERROR:
 >> Could not resolve a key encryption credential

I was just wondering where the problem was, as I was sure that I -DID- 
define encryption credentials. Yes, I did define them. But I did not 
notice my Copy&Paste-Error: They were defined to be used for "signing" 
but not for "encryption". I actually wasn't aware of that parameter to 
be present at all...

---- WRONG ----
<KeyDescriptor use="signing" 
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
---- WRONG ----

---- CORRECT ----
<KeyDescriptor use="encryption" 
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
---- CORRECT ----

Suggestion: As it seems to be a common error too (e.g. 
https://lists.internet2.edu/sympa/arc/shibboleth-users/2010-12/msg00103.html), 
it may be worth adding an INFO-Level message stating something like:

 >> INFO ...... : Credentials found for use="signing", not using them as 
use="encryption" is required.

Messages like these should help the users helping theirselves quickly.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4467 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20120222/e79099df/attachment.bin