Meteor.js and Shibboleth IP

[Truby Voglund]

Peter,

I am a rookie at setting up an SP to the Shibboleth IdP so I apologize for my lack of knowledge.  But I have fixed the error below and getting a new one.  The error is,

Message was not yet valid: message time was 2015-06-25T23:10:20.000Z, latest valid is: 2015-06-25T17:15:28.388-04:00

I can attach the entire error log, but from email below looks like you know how to get there.  Is both these times in Zulu?

Thanks for help,

Truby

________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Thursday, June 25, 2015 1:42 PM
To: users at shibboleth.net
Subject: Re: Meteor.js and Shibboleth IP

You do provide zero context or technical details, but I poked around
at http://tuadevshibbolet.cloudapp.net and used publicly available
information.
When clicking on "OpenIDP" a pop-up window for the testshib IDP which
is not the OpenIDP opens, with the error message

> Error Message: Error decoding authentication request message

and the URL to view the testshib IDP's logfile:
http://idp.testshib.org/cgi-bin/idplog.cgi?lines=300

There you will find the cause of the decoding error:

15:32:32.217 - DEBUG
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:366]
- Decoding message with decoder binding
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'

15:32:32.218 - WARN
[edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:400]
- Error decoding authentication request message
org.opensaml.ws.message.decoder.MessageDecodingException: This message
decoder only supports the HTTP POST method

So your SAML Service Provider sent a HTTP GET request with a SAML2.0
authentication request to an endpoint that is meant for HTTP POST
requests only.
To fix this: Wherever you told your SAML SP to send messages to
https://idp.testshib.org/idp/profile/SAML2/POST/SSO
replace that URL with
https://idp.testshib.org//idp/profile/SAML2/Redirect/SSO
and this error should vanish.

The authentication request itself looks OK, but has a few
peculiarities: it requests a NameID format of
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" (which
testshib doesn't support, AFAIK, and you can't rely on any other IDP
to do so either), and it specifically requests an AuthnContextClassRef
of
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport",
which will be fine for many Shibboleth IDP deployments, including
testshib, but there's simply no reason to request that, as that
prvents use of anything better the IDP has to offer.

>From the tone of your request you probably don't care about any of
this now, so this is all JFYI.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net