Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

[Cahill, Charles (GE Appliances)]

Can anyone tell me if I need to change something on the IDP side to get it to talk on https.
Seems like it only wants to talk on http

I am getting the below errors now

14:10:32.314 [http-bio-8080-exec-1] DEBUG o.o.c.b.d.BaseSAMLMessageDecoder - Checking SAML message intended destination endpoint against receiver endpoint
14:10:32.314 [http-bio-8080-exec-1] DEBUG o.o.c.b.d.BaseSAMLMessageDecoder - Intended message destination endpoint: https://fssfedidpext.xxx.com/idp/profile/SAML2/POST/SSO
14:10:32.314 [http-bio-8080-exec-1] DEBUG o.o.c.b.d.BaseSAMLMessageDecoder - Actual message receiver endpoint: http://fssfedidpext.xxx.com/idp/profile/SAML2/POST/SSO
14:10:32.316 [http-bio-8080-exec-1] ERROR o.o.c.b.d.BaseSAMLMessageDecoder - SAML message intended destination endpoint 'https://fssfedidpext.xxx.com/idp/profile/SAML2/POST/SSO' did not match the recipient endpoint 'http://fssfedidpext.xxx.com/idp/profile/SAML2/POST/SSO'
14:10:32.323 [http-bio-8080-exec-1] WARN  e.i.m.s.i.p.saml2.SSOProfileHandler - Message did not meet security requirements

-----Original Message-----
From: Cahill, Charles (GE Appliances) 
Sent: Wednesday, July 15, 2015 10:10 AM
To: Shib Users
Subject: RE: Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

FYI

I found that the issues here was a the pager duty admin put a space at the end of the login URL I gave him.
I noticed this by using SAML Tracer.  There was a %20 after the Login URL it was trying to call.

Charles Cahill
SSO/LDAP/Web Application Support

Desk 502 452-4737  
Cell   502 541-5702
Charles.Cahill at ge.com


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, July 09, 2015 5:50 PM
To: Shib Users
Subject: Re: Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

On 7/9/15, 5:22 PM, "users on behalf of Cahill, Charles (GE Appliances)" <users-bounces at shibboleth.net on behalf of Charles.Cahill at ge.com> wrote:

>It looks to me like the IDP is trying to post the handler info on port 80 instead of 443.

I didn't pick up on that and I can't think why that would result in that error, but no, that isn't what you want.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net