Shibboleth SP Leading to 404

[Christopher Bongaarts]

On 3/14/2013 4:14 PM, Cantor, Scott wrote:
> On 3/14/13 5:07 PM, "Jeff Gehly"<gehly_jeffrey at bah.com>  wrote:
>
>> >Sorry about the confusion (it's been a long day of running into a mental
>> >brick wall with this problem).  I had setup the WebLogic IdP to log SAML2
>> >events and that's what I meant in my statement about the IdP redirect.
>> >The
>> >IdP log shows an HTTP GET with a redirect call in it that specifies a
>> >hashed
>> >SAMLRequest string ("GET /saml2/idp/sso/redirect?SAMLRequest=<hashed
>> >string>").  This GET call is where the 404 is happening.
> It's not hashed, but yes, that's going to the IdP. Whatever that is,
> involves your IdP setup. It's not Shibboleth, so there's not much I can
> say other than to look at whatever that documentation might say about the
> setup. I assume WebLogic itself is just the container, I don't think it
> acts as an IdP itself. Something's wrong with your IdP application I guess.

Another possible problem would be if the SP has incorrect metadata for 
the IdP loaded that specifies an invalid SingleSignonService location.  
The GET string you quoted seems plausible, though, in which case it 
would be a matter of ensuring WebLogic (and/or the web server) are 
properly routing the SSO location to WebLogic's IdP (and the IdP is 
enabled/configured).  For example, if you're using name-based virtual 
hosts, be sure that the SSO URL is using the vhost the web server and 
WebLogic are expecting.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%