Error after authentication: No peer endpoint available to which to send SAML response

[Andrej Gregorka]

Thank you fort the reply. It's possible my SP is misconfigured, but i'm not sure where or what to look for.

I have changed the following settings in /etc/shibboleth/shibboleth2.xml file:

1) Application Defaults:
    <ApplicationDefaults entityID="https://netshib.ixtlan-dev.si:8443/idp/shibboleth"
                         REMOTE_USER="eppn persistent-id targeted-id" attributePrefix="AJP_">

2) Sessions/SSO:
            <SSO entityID="https://netshib.ixtlan-dev.si:8443/idp/shibboleth">
              SAML2 SAML1
            </SSO>

3) MetadataProvider:
        <MetadataProvider type="XML" uri="https://netshib.ixtlan-dev.si:8443/idp/shibboleth" 
        backingFilePath="idp92-metadata.xml" reloadInterval="7200"/>



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Monday, April 13, 2015 4:57 PM
To: users at shibboleth.net
Subject: Re: Error after authentication: No peer endpoint available to which to send SAML response

* Andrej Gregorka <Andrej.Gregorka at ixtlan-team.si> [2015-04-13 16:47]:
> <samlp:AuthnRequest
>     AssertionConsumerServiceURL="https://netshib.ixtlan-dev.si/Shibboleth.sso/SAML2/POST"
>     Destination="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/Redirect/SSO"
>     ID="_5137de30e536fce539345aacbba9ffe0"
>     IssueInstant="2015-04-13T14:24:33Z"
>     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>     Version="2.0" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
>     <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://netshib.ixtlan-dev.si:8443/idp/shibboleth</saml:Issuer>
>     <samlp:NameIDPolicy AllowCreate="1"/> </samlp:AuthnRequest>

The Issuer of the AuthnRequest (i.e., the SAML SP) calls itself https://netshib.ixtlan-dev.si:8443/idp/shibboleth which would hint at a misconfigured SP, thinking its name is that of the IDP.

Unrelated to that error but there's also no reason to include port numbers in entityIDs, these are just names to uniquely identify an entity. (If you changed the entityID you'd have to change the metadata each party has on record for that entity, too, of course.) -peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net