Meteor.js and Shibboleth IP

[Peter Schober]

You do provide zero context or technical details, but I poked around
at http://tuadevshibbolet.cloudapp.net and used publicly available
information.
When clicking on "OpenIDP" a pop-up window for the testshib IDP which
is not the OpenIDP opens, with the error message

> Error Message: Error decoding authentication request message

and the URL to view the testshib IDP's logfile:
http://idp.testshib.org/cgi-bin/idplog.cgi?lines=300

There you will find the cause of the decoding error:

15:32:32.217 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:366]
- Decoding message with decoder binding
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'

15:32:32.218 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400]
- Error decoding authentication request message
org.opensaml.ws.message.decoder.MessageDecodingException: This message
decoder only supports the HTTP POST method

So your SAML Service Provider sent a HTTP GET request with a SAML2.0
authentication request to an endpoint that is meant for HTTP POST
requests only.
To fix this: Wherever you told your SAML SP to send messages to
https://idp.testshib.org/idp/profile/SAML2/POST/SSO
replace that URL with
https://idp.testshib.org//idp/profile/SAML2/Redirect/SSO
and this error should vanish.

The authentication request itself looks OK, but has a few
peculiarities: it requests a NameID format of
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" (which
testshib doesn't support, AFAIK, and you can't rely on any other IDP
to do so either), and it specifically requests an AuthnContextClassRef
of
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
which will be fine for many Shibboleth IDP deployments, including
testshib, but there's simply no reason to request that, as that
prvents use of anything better the IDP has to offer.

>From the tone of your request you probably don't care about any of
this now, so this is all JFYI.
-peter