Issues getting PagerDuty which uses SAML 2.0 to talk to Shibboleth IDP.

[Cantor, Scott]

On 7/17/15, 6:18 PM, "users on behalf of Cahill, Charles (GE Appliances)" <users-bounces at shibboleth.net on behalf of Charles.Cahill at ge.com> wrote:

>Finally,  I have the IDP Login page coming up... shew !!!
> 
>Now, another error to deal with.  Can you guys see what is going on here?

Yes, documented thousands of times in the archive and on the common error page for the V2 IdP under Troubleshootoing. Your metadata's wrong.

>18:05:57.761 [http-bio-8443-exec-7] DEBUG o.o.s.b.AuthnResponseEndpointSelector - Filtering peer endpoints.  Supported peer endpoint bindings: [urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign, urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST,
> urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact]
>18:05:57.761 [http-bio-8443-exec-7] DEBUG o.o.s.b.AuthnResponseEndpointSelector - Removing endpoint https://xxx.pagerduty.com/Shibboleth.sso/SAML2/ECP because its binding
> urn:oasis:names:tc:SAML:2.0:bindings:PAOS is not supported

Why do you have endpoints in the metadata that are specific to a Shibboleth SP? There's no chance this is a Shibboleth SP.

>18:05:57.762 [http-bio-8443-exec-7] DEBUG o.o.s.b.AuthnResponseEndpointSelector - Selecting endpoint by ACS URL 'https://xxx.pagerduty.com/sso/saml/consume' and protocol binding 'null' for request '_f1bab130-0efd-0133-677c-22000adc166c' from entity 'https://xxx.pagerduty.com'

The SP is requesting a response back to that URL and without specifying a binding.

>18:05:57.762 [http-bio-8443-exec-7] WARN  o.o.s.b.AuthnResponseEndpointSelector - Relying party 'https://xxx.pagerduty.com' requested the response to be returned to endpoint with ACS URL 'https://xxx.pagerduty.com/sso/saml/consume'
> and binding 'any' however no endpoint, with that URL and using a supported binding,  can be found in the relying party's metadata

And that's the error.

-- Scott