Shibboleth SP Leading to 404

[Cantor, Scott]

On 3/14/13 5:07 PM, "Jeff Gehly" <gehly_jeffrey at bah.com> wrote:

>Sorry about the confusion (it's been a long day of running into a mental
>brick wall with this problem).  I had setup the WebLogic IdP to log SAML2
>events and that's what I meant in my statement about the IdP redirect.
>The
>IdP log shows an HTTP GET with a redirect call in it that specifies a
>hashed
>SAMLRequest string ("GET /saml2/idp/sso/redirect?SAMLRequest=<hashed
>string>").  This GET call is where the 404 is happening.

It's not hashed, but yes, that's going to the IdP. Whatever that is,
involves your IdP setup. It's not Shibboleth, so there's not much I can
say other than to look at whatever that documentation might say about the
setup. I assume WebLogic itself is just the container, I don't think it
acts as an IdP itself. Something's wrong with your IdP application I guess.

>Part of what this particular IdP does is issue a redirect back to the
>originally requested resource after authenticating the user.

No, that's what an SP does, after it processes the SAML response.

>I wasn't sure
>if somehow Shibboleth was misconfigured and responsible for the 404
>returned
>by that redirect or not.

No.

>I didn't really know for sure if the problem resides with Shibboleth's SP
>but by this point I've gotten sort of desperate.  I reached out here in
>hopes that either someone could spot what I had done wrong in setting up
>Shibboleth, or help me eliminate Shibboleth as the problem.  Your response
>was actually quite helpful, because you've just given me some solid proof
>that my problem is something on the IdP.

Yes, it's the IdP.

>Just out of curiosity, would a lack of log activity on the Shibboleth SP
>indicate that the IdP is not returning a SAML2 message?  When I get the
>404,
>there is absolutely no activity from the SP.

If the SP got a SAML response from the client, you'd see log activity, or
if nothing else the web server on that end would show a request, yes. A
404 is a web server layer issue, it's really got nothing to do with the
SAML components on either end directly.

-- Scott