Problems getting a new Idp talking to testshib

[Nate Klingenstein]

Brad,

The error means about what it says it means: there is no SAMLRequest  
query parameter arriving with the query to your IdP.  A well-formed  
query parameter would look like:

https://your.idp.here/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZLLboMwFER%2FBXkfDM6LWAGJJotGShsUaBfdVAZMsGRs6mv6%2BPuSkLZppWZn%0A2XNn7hx5CayRLY07W6s9f%2Bk4WOe9kQro6SFEnVFUMxBAFWs4UFvQNL7bUuJ6%0AtDXa6kJL5MQA3Fih1Uor6BpuUm5eRcEf9tsQ1da2QDGG1rW9P9Qid7U54LQ%2F%0A5FpyW7sAGh9tCU52aYacda8Tih0df%2BZF%2Bcegv8D9DpWQ%2FDy956UwvLA4TXfI%0A2axD9FxOSVCWs%2FGELWZVULGAzfNgXlTFbOFztmC9DKDjGwWWKRsi4vlk5E1H%0AZJJ5Y0oI9ckTcpJz1RuhSqEO17nkgwjobZYlo6HRIzdwatMLULQ80qWnYHPB%0A%2B7ot%2B4KMov%2BQwjfSEbRLfJEyRLb0vrfdrBMtRfHhxFLqt5XhzPIQ%2BQhHw8jv%0A%2FxB9Ag%3D%3D%0A

For some reason, when the query is sent to the IdP, there is no such  
query parameter associated with it.

If you can use a tool such as Live Headers to track the HTTP messages,  
you may be able to see if the request is getting munged by some  
intermediate box.  Also be wary of redirects and rewrites.

Sorry to have no more specific advice,
Nate.

On May 24, 2012, at 2:55 , Brad Larson wrote:

> I apologize if the answer here is obvious, I can't find anything.
>
> I'm trying to set up an Idp and test it with testshib.  I haven't
> configured any user authentication yet.
>
> My Idp is giving me an error:
>
> WARN  
> [edu 
> .internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler: 
> 373]
> - Error decoding authentication request message
> org.opensaml.ws.message.decoder.MessageDecodingException: No
> SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP
> Redirect message
>
> One possible issue I'm not sure about - I might not have the SOAP
> endpoints configured correctly
> (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare 
> ).
> Could that be related?  I couldn't determine from the docs if I
> should have my user-facing Idp without clientAuth and the SOAP portion
> with clientAuth on the same port (or how that would even be
> possible...), but I assume they both must be on 443?
>
> Many thanks for any and all help,
> Brad
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net