Problems getting a new Idp talking to testshib

[Brad Larson]

Many thanks Nate.

Using Live Headers I see the original request with the query
parameter. This gets redirected to /idp/AuthEngine.  Then it gets
redirected to /idp/Authn/RemoteUser.  Then back to
/idp/profile/SAML2/Redirect/SSO (with no query parameter).  I thought
I was following the wiki correctly, and that I could use testshib
without setting up an authentication mechanism, but maybe I was
mistaken or missed a step.  I'll start digging through the wiki some
more.

Thanks!
Brad


On Wed, May 23, 2012 at 10:24 PM, Nate Klingenstein <ndk at internet2.edu> wrote:
> Brad,
>
> The error means about what it says it means: there is no SAMLRequest
> query parameter arriving with the query to your IdP.  A well-formed
> query parameter would look like:
>
> https://your.idp.here/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fZLLboMwFER%2FBXkfDM6LWAGJJotGShsUaBfdVAZMsGRs6mv6%2BPuSkLZppWZn%0A2XNn7hx5CayRLY07W6s9f%2Bk4WOe9kQro6SFEnVFUMxBAFWs4UFvQNL7bUuJ6%0AtDXa6kJL5MQA3Fih1Uor6BpuUm5eRcEf9tsQ1da2QDGG1rW9P9Qid7U54LQ%2F%0A5FpyW7sAGh9tCU52aYacda8Tih0df%2BZF%2Bcegv8D9DpWQ%2FDy956UwvLA4TXfI%0A2axD9FxOSVCWs%2FGELWZVULGAzfNgXlTFbOFztmC9DKDjGwWWKRsi4vlk5E1H%0AZJJ5Y0oI9ckTcpJz1RuhSqEO17nkgwjobZYlo6HRIzdwatMLULQ80qWnYHPB%0A%2B7ot%2B4KMov%2BQwjfSEbRLfJEyRLb0vrfdrBMtRfHhxFLqt5XhzPIQ%2BQhHw8jv%0A%2FxB9Ag%3D%3D%0A
>
> For some reason, when the query is sent to the IdP, there is no such
> query parameter associated with it.
>
> If you can use a tool such as Live Headers to track the HTTP messages,
> you may be able to see if the request is getting munged by some
> intermediate box.  Also be wary of redirects and rewrites.
>
> Sorry to have no more specific advice,
> Nate.
>
> On May 24, 2012, at 2:55 , Brad Larson wrote:
>
>> I apologize if the answer here is obvious, I can't find anything.
>>
>> I'm trying to set up an Idp and test it with testshib.  I haven't
>> configured any user authentication yet.
>>
>> My Idp is giving me an error:
>>
>> WARN
>> [edu
>> .internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:
>> 373]
>> - Error decoding authentication request message
>> org.opensaml.ws.message.decoder.MessageDecodingException: No
>> SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP
>> Redirect message
>>
>> One possible issue I'm not sure about - I might not have the SOAP
>> endpoints configured correctly
>> (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare
>> ).
>> Could that be related?  I couldn't determine from the docs if I
>> should have my user-facing Idp without clientAuth and the SOAP portion
>> with clientAuth on the same port (or how that would even be
>> possible...), but I assume they both must be on 443?
>>
>> Many thanks for any and all help,
>> Brad
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net