Error after authentication: No peer endpoint available to which to send SAML response

[Andrej Gregorka]

Hello,

I'm new to Shibboleth and i'm trying to set it up as SSO for couple of applications. I have installed Shibboleth IdP and SP. I have managed to have the login page show up and have the user authenticate against OpenLDAP. But after that i'm stuck with error  >No peer endpoint available to which to send SAML response.<


In the idp-process.log i see the following error:

14:21:46.411 - INFO [Shibboleth-Access:73] - 20150413T142146Z|10.10.1.2|netshib.ixtlan-dev.si:8443|/profile/Metadata/SAML|
14:24:33.488 - INFO [Shibboleth-Access:73] - 20150413T142433Z|10.10.1.2|netshib.ixtlan-dev.si:8443|/profile/SAML2/Redirect/SSO|
14:24:33.489 - DEBUG [PROTOCOL_MESSAGE:113] -
<?xml version="1.0" encoding="UTF-8"?>
<samlp:AuthnRequest
    AssertionConsumerServiceURL="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML2/POST"
    Destination="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/Redirect/SSO"
    ID="_5137de30e536fce539345aacbba9ffe0"
    IssueInstant="2015-04-13T14:24:33Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://netshib.ixtlan-dev.si:8443/idp/shibboleth</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="1"/>
</samlp:AuthnRequest>

14:24:33.490 - WARN [org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81] - SPSSODescriptor role metadata for entityID 'https://netshib.ixtlan-dev.si:8443/idp/shibboleth' could not be resolved
14:24:33.490 - INFO [org.opensaml.common.binding.security.SAMLProtocolMessageXMLSignatureSecurityPolicyRule:100] - SAML protocol message was not signed, skipping XML signature processing
14:24:33.495 - INFO [Shibboleth-Access:73] - 20150413T142433Z|10.10.1.2|netshib.ixtlan-dev.si:8443|/profile/SAML2/Redirect/SSO|
14:24:33.498 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://netshib.ixtlan-dev.si:8443/idp/shibboleth




>From what I have seen on some web sites the problem could be if AssertionConsumerServiceURL in SAML request would not be the same as URL in SP metadata. But the SP metadata has correct AssertionConsumerService URLs:

....
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML2/POST" index="1"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML2/Artifact" index="3"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML2/ECP" index="4"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML/POST" index="5"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML/Artifact" index="6"/>
  </md:SPSSODescriptor>
....


I have checked the troubleshooting page (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTroubleshootingCommonErrors ), but I'm not not really sure what else to look for to resolve the error?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150413/e92443c2/attachment-0001.html