Relying Party

[Brent Putman]

On 4/3/13 3:23 PM, Stein, Eric wrote:
> I'm having issues with my relying-party configuration, and I'm not sure what the problem is. I'm seeing an error that my relying party configuration is incorrect. I thought I correctly followed the directions on the shib page. Attached are the idp log and relying-party.xml file. Does anybody know what might be the issue?



I don't see any errors about your relying-party.xml.  What I do see is:

> 10:43:45.564 - WARN
> [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] -
> Relying party 'https://my.shib.server.com/shibboleth' requested the
> response to be returned to endpoint with ACS URL
> 'http://my.shib.server.com/Shibboleth.sso/SAML2/POST'  and binding
> 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint,
> with that URL and using a supported binding,  can be found in the
> relying party's metadata
> 10:43:45.580 - ERROR
> [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429]
> - No return endpoint available for relying party
> https://my.shib.server.com/shibboleth



which indicates that the metadata that the IdP has for the SP doesn't
contain an HTTP-POST  ACS endpoint
'http://my.shib.server.com/Shibboleth.sso/SAML2/POST'.    Double-check
the schemes there, http vs https, or better, make the SP use https all
around.


--Brent