PasswordProtectedTransport Authentication with MCB

[Brent Putman]

On 6/23/15 8:45 PM, IAM David Bantz wrote:
>
> 12:37:43.141 - WARN
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400]
> -
>                         Error decoding authentication request
> message org.opensaml.ws.message.decoder.MessageDecodingException:
>                         No SAMLRequest or SAMLResponse query path
> parameter, invalid SAML 2 HTTP Redirect message
>


I don't think this has anything to do with the other stuff you
mentioned.  They are simply not sending a valid SAML 2 Redirect binding
request.  Most likely they are doing the POST binding, but mistakenly
sending it to the IdP's Redirect endpoint.  Just change the binding or
the endpoint in use.

If that's not it, then the message means what it says: there's literally
not a query parameter called in SAMLRequest in the HTTP request to the
IdP.  You should be able to see exactly what they are sending in your
browser, possibly using Firefox Live Headers or SAML Tracer.

All the other stuff you mentioned re: the MCB, authN contexts, etc, is
not related to the above error.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150623/7c58e4b9/attachment.html>