SAML response error: No return endpoint available for relying party
jfu
jfu_gengyue at hotmail.com
Fri Nov 29 15:08:53 EST 2013
Hi,
We have shibboleth 2.4 as IDP and try to access a simpleSAMLphp remote SP.
I followed this post
http://shibboleth.1660669.n2.nabble.com/Forwarding-authentication-request-error-404-ExternalAuth-SOLVED-td7310618.html
for external authentication, but after I submitted the form, I got the
following error:
14:41:31.603 - ERROR
[edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447]
- *No return endpoint available for relying party
*http://SP_IP_Address/simplesamlphp/www/module.php/saml/sp/metadata.php/default-sp
I have checked IdPTroubleshootingCommonErrors, and I see no issues.
*IDP entity ID *is entityID="https://test.mycompany.com/idp/shibboleth"
*here is my source code *
==== ExternalAuth Config in handler.xml=====
<ph:LoginHandler xsi:type="ph:ExternalAuthn" externalAuthnPath="index.jsp"
supportsForcedAuthentication="true">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
</ph:LoginHandler>
===== Detail information of SP ======
<md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol
urn:oasis:names:tc:SAML:2.0:protocol">
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/saml2-logout.php/default-sp"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/saml2-acs.php/default-sp"
index="0"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
Location="http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/saml1-acs.php/default-sp"
index="1"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
Location="http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/saml2-acs.php/default-sp"
index="2"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
Location="http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/saml1-acs.php/default-sp/artifact"
index="3"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:profiles:holder-of-key:SSO:browser"
Location="http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/saml2-acs.php/default-sp"
index="4"/>
===== Part of my IDP metadata ===========
<ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="https://test.mycompany.com:8443/idp/profile/SAML1/SOAP/ArtifactResolution"
index="1" />
<ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://test.mycompany.com:8443/idp/profile/SAML2/SOAP/ArtifactResolution"
index="2" />
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://test.mycompany.com/idp/profile/SAML2/Redirect/SLO" />
<SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://test.mycompany.com/idp/profile/SAML2/POST/SLO" />
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://test.mycompany.com:8443/idp/profile/SAML2/SOAP/SLO" />
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
<SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="https://test.mycompany.com/idp/profile/Shibboleth/SSO" />
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://test.mycompany.com/idp/profile/SAML2/POST/SSO" />
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="https://test.mycompany.com/idp/profile/SAML2/POST-SimpleSign/SSO"
/>
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://test.mycompany.com/idp/profile/SAML2/Redirect/SSO" />
========== index.jsp ==================
<%@ page language="java" contentType="text/html; charset=utf-8"
pageEncoding="utf-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Test Tranzlogic</title>
</head>
<body>
<form action="/idp/servlet/externalAuth" method="POST">
Username:<input type="text" name="username" maxlength="20"
id="username" value="" />
<br />
pwd:<input type="password" name="password" maxlength="20"
id="password" value=""><br />
<input type="submit" value="Commit">
</form>
</body>
</html>
=========== Java Servlet ==============
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String username=request.getParameter("username");
String pwd=request.getParameter("password");
boolean authenticated=true;
// do authentication here
if(authenticated){
request.setAttribute("forceAuthn", true);
request.setAttribute("isPassive", true);
Principal principal = new UsernamePrincipal(username);
Subject subj = new Subject();
subj.getPrincipals().add(principal);
request.setAttribute(LoginHandler.PRINCIPAL_KEY, principal);
request.setAttribute(LoginHandler.PRINCIPAL_NAME_KEY,
username);
request.setAttribute(LoginHandler.SUBJECT_KEY, subj);
request.setAttribute("authnMethod",
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport");
request.setAttribute("relyingParty",
"http://SP_IP_Address/simplesamlphp/www/module.php/saml/sp/metadata.php/default-sp");
// required fields that need to login to SP portal
request.setAttribute("ID1", "1000003");
request.setAttribute("ID2", "");
request.setAttribute("UserType", "I");
AuthenticationEngine.returnToAuthenticationEngine(request,
response);
} else {
request.setAttribute("loginFailed", "true"); //
request.getRequestDispatcher("/index.jsp").forward(request,
response);
}
}
*One thing I do notice is that when I make IDP initiated
request:*https://test.mycompany.com/idp/profile/Shibboleth/SSO
?shire=http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/saml2-acs.php/default-sp
&target=State=http://SP_IP_address/simplesamlphp/www/module.php/core/webhome/saml_auth_index.php
&providerId=http://SP_IP_address/simplesamlphp/www/module.php/saml/sp/metadata.php/default-sp
I am redirected to index.jsp, which is correct. however, I see the URL
changed to http://test.mycompany.com/idp/AuthnEngine
should it be https? Is this because https changed to http caused the error I
got?
Please help. I have been stuck on this error for a couple of days.
Thank you.
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SAML-response-error-No-return-endpoint-available-for-relying-party-tp7591912.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
More information about the users
mailing list