Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

[Cahill, Charles (GE Appliances)]

Finally, a different error :)

Thank you Peter, you are the man.

It is still now working, but this is finally some progress.  I was giving Pager Duty the wrong Login URL as you stated.
The new Error states this

Jul 09, 2015 2:08:15 PM org.apache.catalina.core.StandardWrapperValve invoke
INFO: 14:08:15.537 [http-bio-8080-exec-1] TRACE e.i.m.s.idp.session.IdPSessionFilter - Attempting to retrieve IdP session cookie.
14:08:15.538 [http-bio-8080-exec-1] INFO  Shibboleth-Access - 20150709T180815Z|3.101.113.148|3.101.113.148:80|/profile/SAML2/POST/SSO |
14:08:15.538 [http-bio-8080-exec-1] INFO  Shibboleth-Access - 20150709T180815Z|3.101.113.148|3.101.113.148:80|/profile/SAML2/POST/SSO |
14:08:15.538 [http-bio-8080-exec-1] DEBUG e.i.m.s.i.p.IdPProfileHandlerManager - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/POST/SSO 
14:08:15.538 [http-bio-8080-exec-1] DEBUG e.i.m.s.i.p.IdPProfileHandlerManager - shibboleth.HandlerManager: No profile handler registered for request path /SAML2/POST/SSO 
14:08:15.538 [http-bio-8080-exec-1] WARN  e.i.m.s.c.p.ProfileRequestDispatcherServlet - No profile handler configured for request at path: /SAML2/POST/SSO 
14:08:15.539 [http-bio-8080-exec-1] DEBUG e.i.m.s.idp.util.HttpServletHelper - LoginContext key cookie was not present in request
14:08:15.539 [http-bio-8080-exec-1] DEBUG e.i.m.s.idp.ui.ServiceContactTag - No relying party, nothing to display

Jul 09, 2015 2:08:15 PM org.apache.catalina.core.StandardWrapperValve invoke
INFO: 14:08:15.666 [http-bio-8080-exec-9] TRACE e.i.m.s.idp.session.IdPSessionFilter - Attempting to retrieve IdP session cookie.
14:08:15.666 [http-bio-8080-exec-9] INFO  Shibboleth-Access - 20150709T180815Z|3.101.113.148|3.101.113.148:80|/profile/SAML2/POST/simple.css|
14:08:15.666 [http-bio-8080-exec-9] INFO  Shibboleth-Access - 20150709T180815Z|3.101.113.148|3.101.113.148:80|/profile/SAML2/POST/simple.css|
14:08:15.666 [http-bio-8080-exec-9] DEBUG e.i.m.s.i.p.IdPProfileHandlerManager - shibboleth.HandlerManager: Looking up profile handler for request path: /SAML2/POST/simple.css
14:08:15.666 [http-bio-8080-exec-9] DEBUG e.i.m.s.i.p.IdPProfileHandlerManager - shibboleth.HandlerManager: No profile handler registered for request path /SAML2/POST/simple.css
14:08:15.666 [http-bio-8080-exec-9] WARN  e.i.m.s.c.p.ProfileRequestDispatcherServlet - No profile handler configured for request at path: /SAML2/POST/simple.css
14:08:15.667 [http-bio-8080-exec-9] DEBUG e.i.m.s.idp.util.HttpServletHelper - LoginContext key cookie was not present in request
14:08:15.667 [http-bio-8080-exec-9] DEBUG e.i.m.s.idp.ui.ServiceContactTag - No relying party, nothing to display

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Thursday, July 09, 2015 11:32 AM
To: users at shibboleth.net
Subject: Re: Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

Charles,

* Cantor, Scott <cantor.2 at osu.edu> [2015-07-09 17:15]:
> All I know is the message is not valid for the binding supported at 
> the endpoint. You have provided nothing else for me to go on. Either 
> the endpoint's wrong or the message is bad.

Right. Looking at the HTTP request header in the web browser you'll quickly see that the endpoint is wrong:

  POST https://urldefense.proofpoint.com/v2/url?u=https-3A__fssfedidpext.geappliances.com_idp_profile_SAML2_Redirect_SSO&d=AwICAg&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=Ay4xjbXoe6YvlvYwTANr9ZsOm6cEXvasE-gwLIuoyN8&m=KEfGem4Iv2uv3Ct9KIYGqs6SQpQ3Z1j26LyV8cfSLhk&s=S0VA60tUcJuZXxciD1OzbiaMlRgmHhj5drasYPvM0Y8&e=  HTTP/1.1

I.e., the SP is HTTP-POSTing the SAML authentication request to an endpoint that's meant for use with the HTTP-Redirect binding (not HTTP-POST).

So find the above URL in your tenent configuration at the SP site and change it to end in /idp/profile/SAML2/POST/SSO instead (i.e., replace "Redirect" with "POST").
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net