Need help troubshooting: An issuer was supplied that conflicts with previous results

[joel_emery@archibus.com]

Hi, 

I am seeing the following events: 

1. Client opens https://my.domain.com/protectedresource/
2. Client is redirected to IdP (this is a non-Shibboleth IdP)
3. Client logins
4. Client receives the message: 
opensaml::FatalProfileException at (https://my.domain.com/Shibboleth.sso/SAML2/POST) An issuer was supplied that conflicts with previous results.

Can anyone give guidance to a newbie on best next steps I should take.  I feel stuck.

Sanitized IdP Metadata: 

    <EntityDescriptor entityID="https://idp.bigcorp.com/SAMLService">
        <Extensions>
            <mdalg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
            <mdalg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
            <mdalg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
            <mdalg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <mdalg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
            <mdalg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
            <mdalg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <mdalg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
        </Extensions>
        <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
            <Extensions>
                <shibmd:Scope regexp="false">https://idp.bigcorp.com</shibmd:Scope>
                <mdui:UIInfo>
                    <mdui:DisplayName xml:lang="en">https://idp.bigcorp.com/SAMLService</mdui:DisplayName>
                    <mdui:Description xml:lang="en">https://idp.bigcorp.com/SAMLService</mdui:Description>
                </mdui:UIInfo>
            </Extensions>
            <KeyDescriptor>
                <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>
		<!-- cert snipped -->
                        </ds:X509Certificate>
                    </ds:X509Data>
                </ds:KeyInfo>
                <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
                <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
                <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
                <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
                <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
                <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
            </KeyDescriptor>
            <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
            <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.dev.bigcorpintl.us/default.aspx?application=123456789123456789"/>
            <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.dev.bigcorpintl.us/default.aspx?application=123456789123456789"/>
        </IDPSSODescriptor>
    </EntityDescriptor>


Sanitized SAML response from the IdP: 

<samlp:Response 
        ID="_4101bc68-0226-4ebc-a61e-e4cacb2aae34"
        Version="2.0" IssueInstant="2013-11-26T20:22:44Z"
        Destination="https://my.domain.com/Shibboleth.sso/SAML2/POST"
        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.bigcorp.com/SAMLService
    </saml:Issuer>  
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </samlp:Status>
    <saml:Assertion 
            Version="2.0"
            ID="_d012d006-b59f-4e87-8df7-e82dad1cefed" 
            IssueInstant="2013-11-26T20:22:44Z"
            xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">https://idp.bigcorp.com/SAMLService
        </saml:Issuer>
        <saml:Subject>
            <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">1234567890</saml:NameID>
            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData
                    NotOnOrAfter="2013-11-26T15:27:44Z"
                    Recipient="https://my.domain.com/Shibboleth.sso/SAML2/POST" />
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions 
                NotBefore="2013-11-26T20:20:44Z"
                NotOnOrAfter="2013-11-26T20:24:44Z">
            <saml:AudienceRestriction>
                <saml:Audience>https://my.domain.com</saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement 
                AuthnInstant="2013-11-26T15:22:44Z"
                SessionIndex="bdd6bb36-b0d7-4eed-87da-6e525645731d"
                SessionNotOnOrAfter="2013-11-26T15:27:44Z">
            <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password
                </saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>
    </saml:Assertion>
</samlp:Response>


Joel Emery