Error after authentication: No peer endpoint available to which to send SAML response

[Andrej Gregorka]

I added the ports to following settings in relying-party.xml on IdP and now it works:
    <rp:AnonymousRelyingParty provider="https://netshib.ixtlan-dev.si:8443/idp/shibboleth" defaultSigningCredentialRef="IdPCredential"/>
    <rp:DefaultRelyingParty provider="https://netshib.ixtlan-dev.si:8443/idp/shibboleth" defaultSigningCredentialRef="IdPCredential">

Thank you very much for your help.


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Monday, April 13, 2015 7:50 PM
To: users at shibboleth.net
Subject: Re: Error after authentication: No peer endpoint available to which to send SAML response

On 4/13/2015 12:45 PM, Andrej Gregorka wrote:
> However error is still the same:
> 2015-04-13 19:35:30 WARN OpenSAML.MessageDecoder.SAML2 [3]: no 
> metadata found, can't establish identity of issuer 
> (https://netshib.ixtlan-dev.si/idp/shibboleth)
> 2015-04-13 19:35:30 WARN Shibboleth.SSO.SAML2 [3]: no metadata found, 
> can't establish identity of issuer 
> (https://netshib.ixtlan-dev.si/idp/shibboleth)

The above is the entity ID your SP is configured to use.

The below is what your IdP is configured to use.  They don't match (the metadata includes the port in the entityID), so the SP can't find the metadata.

Ports are not usually included in entityIDs (but they do work).  But you have to change it on both sides...

> <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" 
> xmlns:ds="http://www.w3.org/2000/09/xmldsig#" 
> xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
> entityID="https://netshib.ixtlan-dev.si:8443/idp/shibboleth">


-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net