No peer endpoint available to which to send SAML response

[Ken Weiss]

OK, I can see that in the InCommon metadata my endpoints look like this:

    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dmp2-development.cdlib.org/Shibboleth.sso/SAML2/POST"
index="1"/>


instead of this:

    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dmp2-dev.cdlib.org/Shibboleth.sso/SAML2/POST" index="1"/>


That's really weird, because I generated the metadata in exactly the same
way both times, and there has never been an actual hostname or resolvable
URL using dmp2-development.cdlib.org. My goal was to have an entityID that
is NOT an actual URL/hostname. But clearly things would have been simpler
if I just made the entityID and the hostname the same.

How should I proceed to resolve this? Should I re-send the metadata with
the 'dmp2-dev.cdlib.org' endpoints, as it is in the version I attached to
my first email? Or is there some easier way to deal with this?

--Ken
------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612






On 7/15/13 4:00 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 7/15/13 6:49 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:
>
>>There is absolutely nothing in any of my shibd log files on the SP. The
>>last log entry relates to the restart of the shibd daemon. There are no
>>errors or warnings after that.
>
>That's because the transaction stops at the IdP, so there can't be
>anything else.
>
>>I've attached the complete metadata file and the complete shibboleth2.xml
>>file. I don't have access to anything for the IDP, but if I can just get
>>to a point where I'm confident that my SP configuration and metadata are
>>good, that would be a step forward.
>> Thanks in advance for any assistance.
>
>The endpoints you put in your email are not in fact the ones registered.
>You can see that yourself, just look at the InCommon metadata.
>
>The endpoints that were registered have the hostname you put into the
>entityID, not the one you have the web server configured to use. They
>don't have to match, but the metadata and web server configuration have to
>match.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net