HTTP 404 after get the Authenticated from ADFS

[Cantor, Scott]

On 8/29/14, 11:08 AM, "Matt Ho" <matt.ho at outlook.com> wrote:
>
>HTTP link work fine except HTTPS link (showing above).
>After the ADFS, the return page will be 404 error page not found
>and address show :
>
>https://lib.cpce-polyu.edu.hk/Shibboleth.sso/SAML2/POST

No, I don't think so. Accessing that URL directly is running the handler
in the SP as epxected (I get an SP error page back). So that is NOT
returning a 404, no matter what you do with it. If you see a 404, it's not
coming from that. If you want to prove that run a trace with LiveHeaders
or something similar. The 404 has to be coming from something else.
Alternatively, your network path to that server is not the same as mine is
and the 404 is coming from a proxy, which is out of the SP's control.

>HTTP link work fine also except HTTPS link.
>After the ADFS, it return 404 error page not found and
>the address was missed the first path "0-global.factiva.com.".
>
>Here is the link after return FYI :
>https://lib.cpce-polyu.edu.hk/en/sess/login.asp?XSID=.....
>
>The HTTPS return link after ADFS should be same as before,
>but don't know why the first path of the domain was cut out.

Then you've got some kind of virtual hosting situation with domains being
rewritten and so forth. The SP has been deployed on a server that is not
configured properly and it believes its hostname is lib.cpce.polyu.edu.hk,
so it is requesting that return location and ADFS is returning there.

>Question:
>1/ Any idea why it happened only for the https link?

No. I don't have any insight into how your web servers are all configured
and architected.

>2/ Which log file I should check for the problem?

The SAMLTracer firefox add-on can trace the messages being sent back and
forth and show the AssertionConsumerServiceURL/Destination URLs inside the
messages and illustrate what the components think they're doing. The
shibd.log can be adjusted to log SAML messages as well. You will see what
the domains in the URLs are and where they're broken.

>3/ Which shibboleth config file should handle this?

An Apache web server reports its own hostname, it's not a Shibboleth
issue. IIS is broken and can't do that, so it's handled in the Site
elements inside the SP configuration file.

-- Scott