SAML message delivered with POST to incorrect server URL.

[Tom Haenen]

We have a Shibboleth SP installed using IIS7 and used to work fine. Now we get the following error in production:

opensaml::BindingException at (https://sp.example.org/Shibboleth.sso/SAML2/POST)

SAML message delivered with POST to incorrect server URL.

I followed the instructions on https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTroubleshootingCommonErrors with no success. The SP on the test server still works fine and the configuration is basically identical.

I finally compared the SP metadata  from our repository with a freshly generated one. The newly generated metadata uses the wrong base URL in the RequestInitiator and all services declared in the SPSSODescriptor as follows:

...
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:Extensions>
      <init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://sp.example.org/Shibboleth.sso/Login"/>
    </md:Extensions>
...
    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sp.example.org/Shibboleth.sso/SLO/POST"/>
...

"sp.example.org" does not occur in any of our configuration files. So, where does the base URL come from? I assumed it would come from the reference shibboleth2.xml/SPConfig/InProcess/ISAPI/Site but the reference to the website there is correct.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150907/af247efd/attachment-0001.html>