No peer endpoint available to which to send SAML response

[Ken Weiss]

I know this error has been discussed to death, and I apologize for dragging it back out of the grave, but I can't figure out my particular permutation...

I have a Shibboleth 2 service provider. I generated metadata using the .../Shibboleth.sso/Metadata handler and my local registrar sent that to InCommon. Someone at InCommon has confirmed that they loaded the metadata. The metadata includes the following AssertionConsumerService endpoints:

Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SLO/Artifact"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SAML2/POST" index="1"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SAML2/Artifact" index="3"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SAML2/ECP" index="4"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SAML/POST" index="5"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SAML/Artifact" index="6"/>

I am using a single IDP, the one that the InCommon test site says I should be using for UC Office of the President:

<SSO entityID="urn:mace:incommon:ucop.edu">SAML2 SAML1</SSO>

When I attempt to access a protected URL on my SP, I am redirected to the UCOP IDP and prompted to authenticate. Upon successful authentication, I get the "No peer endpoint available to which to send SAML response" error.

There is absolutely nothing in any of my shibd log files on the SP. The last log entry relates to the restart of the shibd daemon. There are no errors or warnings after that.

I've attached the complete metadata file and the complete shibboleth2.xml file. I don't have access to anything for the IDP, but if I can just get to a point where I'm confident that my SP configuration and metadata are good, that would be a step forward. Thanks in advance for any assistance.

--Ken

------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu<mailto:ken.weiss at ucop.edu>
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130715/f4273b88/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: shibboleth2.xml
Type: application/xml
Size: 7403 bytes
Desc: shibboleth2.xml
Url : http://shibboleth.net/pipermail/users/attachments/20130715/f4273b88/attachment-0001.rdf 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Metadata
Type: application/octet-stream
Size: 5846 bytes
Desc: Metadata
Url : http://shibboleth.net/pipermail/users/attachments/20130715/f4273b88/attachment-0001.obj