PasswordProtectedTransport Authentication with MCB

[IAM David Bantz]

Vendor's SP is sending the following SAML request (according to them):



<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

                    ID="s25d6fccde9c929700b616acf6e3c291122f61a844"

                    Version="2.0"

                    IssueInstant="2015-06-25T21:13:50Z"

                    Destination="
https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO"

                    ForceAuthn="true"

                    IsPassive="false"


ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

                    AssertionConsumerServiceURL="
https://sso.uat.firstmarblehead.com
/openam/Consumer/metaAlias/fmdrealm001/uaaalaska_sso_sp"

                    >

    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
sso.uat.firstmarblehead.com/uaaalaska_sso</saml:Issuer>

    <samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"


Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"

                        SPNameQualifier="sso.uat.firstmarblehead.com
/uaaalaska_sso"

                        AllowCreate="true"

                        />

    <samlp:RequestedAuthnContext
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"

                                 Comparison="exact"

                                 >

        <saml:AuthnContextClassRef
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>

    </samlp:RequestedAuthnContext>

</samlp:AuthnRequest>


which seems to verify Brent's diagnosis (POST request sent to Redirect end
point).  Is there any other obvious problem with the request I could point
out and save a week's turnaround with the vendor technical staff?  Thanks!


David

On Tue, Jun 23, 2015 at 5:19 PM, Brent Putman <putmanb at georgetown.edu>
wrote:

>
>
> On 6/23/15 8:45 PM, IAM David Bantz wrote:
>
>
>  12:37:43.141 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400]
> -
>                         Error decoding authentication request message org.opensaml.ws.message.decoder.MessageDecodingException:
>
>                         No SAMLRequest or SAMLResponse query path
> parameter, invalid SAML 2 HTTP Redirect message
>
>
>
> I don't think this has anything to do with the other stuff you mentioned.
> They are simply not sending a valid SAML 2 Redirect binding request.  Most
> likely they are doing the POST binding, but mistakenly sending it to the
> IdP's Redirect endpoint.  Just change the binding or the endpoint in use.
>
> If that's not it, then the message means what it says: there's literally
> not a query parameter called in SAMLRequest in the HTTP request to the
> IdP.  You should be able to see exactly what they are sending in your
> browser, possibly using Firefox Live Headers or SAML Tracer.
>
> All the other stuff you mentioned re: the MCB, authN contexts, etc, is not
> related to the above error.
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150706/86ea8f7f/attachment-0001.html>