Upgrading SP from SAML1 to SAML2

[John Kamminga]

Hello, I've just taken over a Shibboleth IdP implementation and I went to one training seminar. Woohoo!

I have a Service Provider that is wanting to upgrade from SAML1 to SAML2. My first thought was I don't need to do anything because our IdP already accepts both.

However, they have received an error and asked me to fix it:(
ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party

I checked the Shib Wiki and it states this could be caused by 1 of 3 issues:

1.       No or incorrect Metadata for SP

a.  No metadata

b.  Incorrect metadata

c.  A service provider, issuing a SAML 2 request, sends an assertion consumer service index within a message

I'm not actually sure what this means:(



2.       IdP doesn't support binding specified by SP



3.       SP doesn't specify response endpoint

According to my relying-party configuration I'm accepting both SAML1 and SAML2 but require SAML2 to be signed. How can I tell if the problem is in the SP Metadata?

        <rp:ProfileConfiguration xsi:type="saml:SAML1ArtifactResolutionProfile" signResponses="conditional"
                                 signAssertions="never"/>
        <rp:ProfileConfiguration xsi:type="saml:SAML2ArtifactResolutionProfile"
                                 signResponses="never" signAssertions="always"
                                 encryptAssertions="conditional" encryptNameIds="never"/>

Also, we are running Shibboleth IdP 2.4

Please let me know if you need any more information.
Thanks,
John Kamminga
Web Application Development
Information Technology Department
University of California, Merced
T: 209.228.2965<tel:209.228.2965>
E: jkamminga at ucmerced.edu<mailto:jkamminga at ucmerced.edu>
W: it.ucmerced.edu<http://it.ucmerced.edu/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150313/e124de27/attachment-0001.html