Shibboleth IDP trust with other IDP

[krrishv]

Sorry Scott, I will have to do this two IDP stuff. 

I have configured an apache as per your suggestion in the same box as Shib
IDP and Shib IDP tomcat is listening on 8443 and apache listening on 443 in
the front proxying to Tomcat. Now i see below error. I have updated all the
metadata POST URL's to have only https://win-citrix.krish.com/idp...but
looks like it is requiring me to post only on :8443 Any suggestions on this?


3:27:46.343 - DEBUG [org.opensaml.ws.message.decoder.BaseMessageDecoder:85]
- Successfully decoded message.
23:27:46.343 - DEBUG
[org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:191] - Checking
SAML message intended destination endpoint against receiver endpoint
23:27:46.343 - DEBUG
[org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:210] - Intended
message destination endpoint:
https://win-citrix.krish.com/idp/profile/SAML2/Redirect/SSO
23:27:46.343 - DEBUG
[org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:211] - Actual
message receiver endpoint:
https://win-citrix.krish.com:8443/idp/profile/SAML2/Redirect/SSO
23:27:46.343 - ERROR
[org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML
message intended destination endpoint
'https://win-citrix.krish.com/idp/profile/SAML2/Redirect/SSO' did not match
the recipient endpoint
'https://win-citrix.krish.com:8443/idp/profile/SAML2/Redirect/SSO'
23:27:46.359 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406]
- Message did not meet security requirements
org.opensaml.xml.security.SecurityException: SAML message intended
destination endpoint did not match recipient endpoint
	at
org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:217)
~[opensaml-2.6.0.jar:na]
	at
org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72)
~[opensaml-2.6.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83)
[shibboleth-common-1.4.0.jar:na]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
[servlet-api.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87)
[shibboleth-identityprovider-2.4.0.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52)
[shibboleth-common-1.4.0.jar:na]
	at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
[catalina.jar:6.0.32]
	at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
[catalina.jar:6.0.32]
	at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
[catalina.jar:6.0.32]
	at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
[catalina.jar:6.0.32]
	at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859)
[tomcat-coyote.jar:6.0.32]
	at
org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
[tomcat-coyote.jar:6.0.32]
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
[tomcat-coyote.jar:6.0.32]
	at java.lang.Thread.run(Thread.java:744) [na:1.7.0_45]
23:27:46.437 - DEBUG
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:339] -
LoginContext key cookie was not present in request
23:27:46.437 - DEBUG
[edu.internet2.middleware.shibboleth.idp.ui.ServiceContactTag:177] - No
relying party, nothing to display




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-IDP-trust-with-other-IDP-tp7596134p7596523.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.