Error after authentication: No peer endpoint available to which to send SAML response
Andrej Gregorka
Andrej.Gregorka at ixtlan-team.si
Mon Apr 13 13:45:48 EDT 2015
I have changed the loading of Idp metadata in SP to local file:
<MetadataProvider type="XML" file="idp-metadata.xml"/>
In shibd.log says its loaded:
2015-04-13 19:34:54 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (/etc/shibboleth/idp-metadata.xml)
However error is still the same:
2015-04-13 19:35:30 WARN OpenSAML.MessageDecoder.SAML2 [3]: no metadata found, can't establish identity of issuer (https://netshib.ixtlan-dev.si/idp/shibboleth)
2015-04-13 19:35:30 WARN Shibboleth.SSO.SAML2 [3]: no metadata found, can't establish identity of issuer (https://netshib.ixtlan-dev.si/idp/shibboleth)
2015-04-13 19:35:30 WARN Shibboleth.SSO.SAML2 [3]: detected a problem with assertion: Unable to establish security of incoming assertion.
These are the contents of the idp-metadata.xml:
<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" entityID="https://netshib.ixtlan-dev.si:8443/idp/shibboleth">
<IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
<Extensions>
<shibmd:Scope regexp="false">ixtlan-dev.si</shibmd:Scope>
</Extensions>
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIDPzCCAiegAwIBAgIUPEw3ExgQfn9d53OuDGaae1RoaQ4wDQYJKoZIhvcNAQEF
BQAwIDEeMBwGA1UEAwwVbmV0c2hpYi5peHRsYW4tZGV2LnNpMB4XDTE1MDQwODE0
MTc0NVoXDTM1MDQwODE0MTc0NVowIDEeMBwGA1UEAwwVbmV0c2hpYi5peHRsYW4t
ZGV2LnNpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlhvjEvYoAMp/
RV60jywZBGgr0V0+FdlUqBlDj/vLoHxjbaFVUvNiMCAwkav7xjFk/zbXdhyDC+kU
Ebh/R1hRmhOoUhL5UfUsZxloTFoZ1y7Kt4e7iyQubt7/KBdNmFFW7b5d9YArwmr0
8/P3t/FdwiwXTJYHMj2p7jdn6YyUb+UJS2xA8v7vKdOaz7X7TFowKY3lWgEvj41V
JyIsdabOFINCOeOoUvmXcPspe8iL8C55LE9B/yX3Zv8EyJX0btcBVQNP8HZShs6m
PjBv3/ppv79Zl01jF9ALu+21GiBQM1wHUIDadmfpa+OX6c4Mr4F79dYv9o6ClyrZ
y9rvXqE5zwIDAQABo3EwbzAdBgNVHQ4EFgQUqPl/ARK6ACKLpIIkiNdK14WDIAkw
TgYDVR0RBEcwRYIVbmV0c2hpYi5peHRsYW4tZGV2LnNphixodHRwczovL25ldHNo
aWIuaXh0bGFuLWRldi5zaS9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQUFAAOC
AQEAkwwBl2Byb0h9/+svjaBk5yt2KuaQ1yyVN5jQkM2bvbYC17kw0UuVb/yJA0c5
s875jswh+3alO1YG2IiuqWtmh/ppE64X3fAI9o6D9T1Q+9beTefzb3ppB2l4pe2u
gBUvdmTOXfgUzogJWAqA6eS+S8/vr4tDeTUJ6Ki8XFqqTbEHYPahIgB1oLXmdyX3
tvBIA4BrLHCgFPfv/Bpg0j5iiKLrNruT/tpkC5esV5abNSjxQ+72ZpM87r2t+d7x
MVXirvdNFCOjdg59xlj4NhFdAhdyphV3Z6lolQY0Scf6s1Sl76fe50njqPnkco1q
34DsTX8JFvd4O85mihFw+g/GBQ==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
<ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/Redirect/SLO" />
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/POST/SLO" />
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/SOAP/SLO" />
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
<SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/Shibboleth/SSO"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/POST/SSO"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/POST-SimpleSign/SSO"/>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/Redirect/SSO"/>
</IDPSSODescriptor>
<AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
<Extensions>
<shibmd:Scope regexp="false">ixtlan-dev.si</shibmd:Scope>
</Extensions>
<KeyDescriptor use="signing">
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIDPzCCAiegAwIBAgIUPEw3ExgQfn9d53OuDGaae1RoaQ4wDQYJKoZIhvcNAQEF
BQAwIDEeMBwGA1UEAwwVbmV0c2hpYi5peHRsYW4tZGV2LnNpMB4XDTE1MDQwODE0
MTc0NVoXDTM1MDQwODE0MTc0NVowIDEeMBwGA1UEAwwVbmV0c2hpYi5peHRsYW4t
ZGV2LnNpMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlhvjEvYoAMp/
RV60jywZBGgr0V0+FdlUqBlDj/vLoHxjbaFVUvNiMCAwkav7xjFk/zbXdhyDC+kU
Ebh/R1hRmhOoUhL5UfUsZxloTFoZ1y7Kt4e7iyQubt7/KBdNmFFW7b5d9YArwmr0
8/P3t/FdwiwXTJYHMj2p7jdn6YyUb+UJS2xA8v7vKdOaz7X7TFowKY3lWgEvj41V
JyIsdabOFINCOeOoUvmXcPspe8iL8C55LE9B/yX3Zv8EyJX0btcBVQNP8HZShs6m
PjBv3/ppv79Zl01jF9ALu+21GiBQM1wHUIDadmfpa+OX6c4Mr4F79dYv9o6ClyrZ
y9rvXqE5zwIDAQABo3EwbzAdBgNVHQ4EFgQUqPl/ARK6ACKLpIIkiNdK14WDIAkw
TgYDVR0RBEcwRYIVbmV0c2hpYi5peHRsYW4tZGV2LnNphixodHRwczovL25ldHNo
aWIuaXh0bGFuLWRldi5zaS9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQUFAAOC
AQEAkwwBl2Byb0h9/+svjaBk5yt2KuaQ1yyVN5jQkM2bvbYC17kw0UuVb/yJA0c5
s875jswh+3alO1YG2IiuqWtmh/ppE64X3fAI9o6D9T1Q+9beTefzb3ppB2l4pe2u
gBUvdmTOXfgUzogJWAqA6eS+S8/vr4tDeTUJ6Ki8XFqqTbEHYPahIgB1oLXmdyX3
tvBIA4BrLHCgFPfv/Bpg0j5iiKLrNruT/tpkC5esV5abNSjxQ+72ZpM87r2t+d7x
MVXirvdNFCOjdg59xlj4NhFdAhdyphV3Z6lolQY0Scf6s1Sl76fe50njqPnkco1q
34DsTX8JFvd4O85mihFw+g/GBQ==
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</KeyDescriptor>
<AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>
<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://netshib.ixtlan-dev.si:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>
<NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
</AttributeAuthorityDescriptor>
</EntityDescriptor>
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Monday, April 13, 2015 7:41 PM
To: Shibboleth Users
Subject: Re: Error after authentication: No peer endpoint available to which to send SAML response
On Apr 13, 2015, at 1:09 PM, Andrej Gregorka <Andrej.Gregorka at ixtlan-team.si> wrote:
>
> The shibd.log shows following messages:
> 2015-04-13 18:54:46 WARN OpenSAML.MessageDecoder.SAML2 [3]: no metadata found, can't establish identity of issuer (https://netshib.ixtlan-dev.si/idp/shibboleth)
> 2015-04-13 18:54:46 WARN Shibboleth.SSO.SAML2 [3]: no metadata found, can't establish identity of issuer (https://netshib.ixtlan-dev.si/idp/shibboleth)
> 2015-04-13 18:54:46 WARN Shibboleth.SSO.SAML2 [3]: detected a problem with assertion: Unable to establish security of incoming assertion.
Doesn’t this mean the SP does not have a copy of the IdP’s metadata loaded? Given it’s the shibd.log file.
Paul
-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list