shibidp ECP extension configuration: REMOTE_USER not set

[Joost van Dijk]

On Oct 12, 2012, at 3:40 PM, Ryan Suarez <ryan.suarez at sheridanc.on.ca> wrote:

> On 12-10-11 9:27 AM, Joost van Dijk wrote:
>> Not sure if you already resolved your issues, but I believe that the message in your log file:
>> 
>> No return endpoint available for relying party urn:federation:MicrosoftOnline
>> 
>> has nothing to do with your setup but is related to an issue with Office 365.
>> When a user connects to Microsoft's IMAP server, for example, he/she sends a username and password for authentication that is subsequently relayed to the user's IdP using the SAML ECP profile. That is, a SOAP request is sent from Microsoft's servers to your IdP's ECP endpoint (using HTTP Basic authentication), e.g.
>> 
>> <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
>>   <S:Body>
>>     <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_73ffcfca-e08e-4a4c-88f5-2b8022c61bf2" IssueInstant="2012-10-11T12:06:28.0084232Z" Version="2.0" AssertionConsumerServiceIndex="2">
>>       <saml:Issuer>urn:federation:MicrosoftOnline</saml:Issuer>
>>     </samlp:AuthnRequest>
>>   </S:Body>
>> </S:Envelope>
>> 
>> The problem is (I think) that there is no ACS URL with index 2 listed in Microsoft's Windows Azure AD metadata at
>> https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml
> 
> In their example they have the following entry:
> <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://login.microsoftonline.com/login.srf" index="2" />
> http://technet.microsoft.com/en-us/library/jj205463.aspx
> 
> Adding this in should fix the problem.
> 

You are absolutely right. I was using their online metadata, expecting that to be the same as the verbatim metadata in their docs.
Thanks for pointing this out.
--
Joost

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121013/ede56d3b/attachment.html