Shib IdP 3 and IOP online service

[Rod Widdowson]

> With this request I'm getting an error from

It was just a thought.   I suspect I abused the IdPSSO protocol.  Don’t
worry about it.

> 2015-03-24 12:39:05,229 - DEBUG [PROTOCOL_MESSAGE:166] - 
> SAML 1 IdP-initiated request was:
IdPInitiatedSSORequest{entityId=https://ticket.iop.org/shibboleth,
acsURL=https://ticket.iop.org/Shibboleth.sso/SAML/POST, 
> relayState=cookie:534566a6, time=2015-03-24T11:39:04.000Z}
> and then IdP produces <saml1p:response> and send it to 
> 
> I have the production IdP running simplesamlphp and there all works good.
SAML tracer shows  that first 
> <samlp:AuthnRequest..> is sent, then <samlp:Response> and the POST goes to
SAML2 endpoint https://ticket.iop.org/Shibboleth.sso/SAML2/POST

That cannot be right can it?  If the request asked for ACS
/Shibboleth.sso/SAML/POST, surely you need to send the response back there
(not to a SAML2 endpoint), but that’s a SSP issue and so irrelevant except
that I seem to recall a similar bug being fixed in the Shib IdP.

Do you have another SAML1 SP you can test against? If you are in edugain the
UK Federation one is a handy place to start...

You might also want to check that you attribute resolvers have SAML1
encoders attached.

R