skipEndpointValidationWhenSigned is no more honored after IdP 3 upgrade

[Youssef Ghorbal]

> On 19 Jul 2015, at 02:23, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 7/18/15, 7:58 AM, "users on behalf of Youssef Ghorbal" <users-bounces at shibboleth.net on behalf of youssef.ghorbal at pasteur.fr> wrote:
> 
>> 	But this does not seem to work, the IdP rises an error at the SSO initialiazation :
>> 
>> 2015-07-18 13:54:59,745 - WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:402] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint
>> 
>> 	Everything works fine when Metadata do have Bindings.
> 
> I assume you've verified that the request is in fact signed and that the location and binding to use are both included in it.

I’ve doubled checked that the request is signed :

- SAML Tracer FF plugin shows this :
 
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceURL="https://pasteurid-dev.pasteur.fr/Shibboleth.sso/SAML2/POST"
                    Destination="https://idp-dev.pasteur.fr/idp/profile/SAML2/Redirect/SSO"
                    ID="_fcd9746c6488877c97208291f02c5a9f"
                    IssueInstant="2015-07-19T00:36:51Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://pasteurid-dev.pasteur.fr/</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>

There is also a Signature parameter in the GET URL.

And the IdP trace logs shows this :

DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:199] - Message Handler:  Attempting to validate SAML protocol message simple signature using context entityID: https://pasteurid-dev.pasteur.fr/
DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:286] - Resolving credentials from metadata using entityID: https://pasteurid-dev.pasteur.fr/, role: {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor, protocol: urn:oasis:names:tc:SAML:2.0:protocol, usage: SIGNING
DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:435] - Retrieving role descriptor metadata for entity 'https://pasteurid-dev.pasteur.fr/' in role '{urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor' for protocol 'urn:oasis:names:tc:SAML:2.0:protocol'
DEBUG [org.opensaml.saml.security.impl.MetadataCredentialResolver:354] - Found no cached credentials in KeyDescriptor object metadata, resolving from KeyInfo
DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:271] - Message Handler:  Simple signature validation (with no request-derived credentials) was successful
DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:203] - Message Handler:  Validation of request simple signature succeeded
DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:205] - Message Handler:  Authentication via request simple signature succeeded for context issuer entity ID https://pasteurid-dev.pasteur.fr/
DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler' on INBOUND message context
DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:148] - Message Handler:  Evaluating simple signature rule of type: org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler
DEBUG [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:151] - Message Handler:  Handler can not handle this request, skipping processing

I’m a little bit confused here. At first I see :
Message Handler:  Simple signature validation (with no request-derived credentials) was successful
but later there is :
Message Handler:  Handler can not handle this request, skipping processing

Thank you very much for your assistance.

Youssef