No peer endpoint available to which to send SAML response

[Dave Vernon]

Hi,

The IdP is in fact Shibboleth.

When I try the test, and I look at the idp-process log on the IdP server I see the following:

19:46:09.153 - INFO [Shibboleth-Access:73] - 20141001T234609Z|10.10.12.25|explode.lcaat.ca:444|/profile/SAML2/Redirect/SSO|
19:46:13.872 - INFO [Shibboleth-Access:73] - 20141001T234613Z|10.10.12.25|explode.lcaat.ca:444|/profile/SAML2/Redirect/SSO|
19:46:13.872 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://explode.lcaat.ca/idp/shibboleth


The idp-access log shows events like this
20141001T234613Z|10.10.12.25|explode.lcaat.ca:444|/profile/SAML2/Redirect/SSO|

Nothing in the audit logs.


I restarted the service so I could recapture the startup logs.  I won't copy and paste it all, but everything is 'info' except one (I believe unrelated) warn
19:49:16.467 - WARN [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ComputedIDDataConnector:64] - This data connector is deprecated.  The StoredID data connector should be used in its place.


I haven't come across any type of log that is showing received or discarded info.  Is there another location?

Thanks

________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Nate Klingenstein [ndk at internet2.edu]
Sent: Wednesday, October 01, 2014 7:29 PM
To: Shib Users
Subject: Re: No peer endpoint available to which to send SAML response

Dave,

It looks like a match to me too, which leads me to wonder again about what's getting loaded by that IdP.  Your IdP, if Shibboleth, should be very explicit about what it's loading or receiving and why it's being discarded.

Thanks,
Nate.

On Oct 1, 2014, at 5:10 PM, Dave Vernon <dvernon at loyalistcollege.com> wrote:

> I'm sorry, I should add (regarding your first comment)
>
> In the AuthnRequest I have this ACS
>
> "https://lms.lcaat.ca/Shibboleth.sso/SAML2/POST"
>
> In the SD's metadata on the IdP server I have this in the md:ACS section
>
> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://lms.lcaat.ca/Shibboleth.sso/SAML2/POST" index="1"/>
>
>
> This looks like a match to me?
>
> ________________________________________
> From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
> Sent: Wednesday, October 01, 2014 5:09 PM
> To: Shib Users
> Subject: RE: No peer endpoint available to which to send SAML response
>
>> If anyone out there would be willing the spend the time, I would appreciate
>> any tips on how to go about troubleshooting this.  I've read the
>> documentation, especially about SP metadata several times over, but I feel
>> like I am going in circle and not making any progress.
>
> The AuthnRequest from the SP will contain an AssertionConsumerServiceURL attribute. The location will not be one of the AssertionConsumerService endpoint Locations in the metadata. That's it.
>
> The ACS location generated by the SP is a self-referential location. Understanding how web servers have to be configured to properly allow self-referential links to be generated is basically the entire issue.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net