ADFS Assertion Consumer Service error

[Brian Fox]

Is FF Firefox?

When in SAML tracer the AuthnRequest has:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                     AssertionConsumerServiceURL="https://adfstest.com/sso/SAML2/POST"
                     Destination="https://adfstest.com/adfs/ls/"
.....

	<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://mysite.com/shibboleth</saml:Issuer>


So both AssertionConsumerServiceURL and Destination are pointed to the ADFS site and not my shibboleth site (which is the SP).  The saml:Issuer does seem to be my site.

Does that mean my SP is configured incorrectly or is it the ADFS site?



Thanks

On 5/7/2012 8:51 AM, Paul Hethmon wrote:
> So that error is displayed by the ADFS IdP? If so, I would say that 
> ADFS is misconfigured.
>
> I would suggest tracing the SAML flow with FF and SAML tracer to make 
> sure you are sending the correct Authn Request to the IdP. Make sure 
> that you are sending your entityID and not its entityID, etc.
>
> Paul
>
> From: Brian Fox <dexwest at gmail.com <mailto:dexwest at gmail.com>>
> Reply-To: Shibboleth Users <users at shibboleth.net 
> <mailto:users at shibboleth.net>>
> Date: Monday, May 7, 2012 11:47 AM
> To: Shibboleth Users <users at shibboleth.net <mailto:users at shibboleth.net>>
> Subject: ADFS Assertion Consumer Service error
>
> I am trying to integrate my Shibboleth SP with a ADFS site (as iDP).  
> After the user logins into AD site we see the following error:
> The request specified an Assertion Consumer Service URL 'https://adfstest.com/sso/SAML2/POST' that is not  configured on the relying party 'microsoft:identityserver:MYSP_ENTITYID'.
>
> Based on my metadata my ACS endpoint is configured to:
>      <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://mysite.com/sso/SAML2/POST"  index="0"/>
>
> The ADFS system seems to be replacing my hostname with the ADFS server hostname.  Any ideas how I can solve this?
>
> I have been following the following howto:
>
>
>   AD FS 2.0 Step-by-Step Guide: Federation with Shibboleth 2 and the
>   InCommon Federation
>
>   http://technet.microsoft.com/en-us/library/gg317734(WS.10).aspx  <http://technet.microsoft.com/en-us/library/gg317734%28WS.10%29.aspx>
> Shibboleth version 2.4.3
> ADFS Windows Server 2008 R3
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120507/a8dfa430/attachment.html