SAML message intended destination endpoint did not match the recipient endpoint

[Reid Watson]

Hi Experts, 

Im wondering if I could get some advice and if I’m going down the wrong path / wiil my idea work 

1. Situation  

- Old IDP v2 system (not an option to upgrade to IDP3) 
- We currently have 122 plus external cloud services currently integrated into our IDP 

Current IDP3 Version  
- Jetty 9.3.2.v20150730
- shibboleth-identity-provider-3.2.1 

2. Problem 

- On Go live I wouldn’t be able to communicate with 100 plus vendors to update the Entity ID and AuthnRequest URL to point to the new IDP3 

 3. My Idea - Configure an Apache Reverse Proxy from IDP2 to IDP3 for the SAML request 

No I have already setup the Reverse Proxy but I’m returned this error IDP3 server 

2016-07-02 14:38:26,955 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:200] - Message Handler:  SAML message intended destination endpoint 'https://iam.dev.auckland.ac.nz/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://iam.dev.auckland.ac.nz/idp/profile/SAML2/Redirect/SSO'
2016-07-02 14:38:26,957 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: SAML message failed received endpoint check
        at org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler.checkEndpointURI(ReceivedEndpointSecurityHandler.java:202)
2016-07-02 14:38:26,959 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: MessageAuthenticationError

 - Looking at the error “destination endpoint 'https://iam.dev.auckland.ac.nz/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://iam.dev.auckland.ac.nz/idp/profile/SAML2/Redirect/SSO'” the path is causing, so the server itself dosen’t match the urls being given in the SAML messages

IDP2 Path: /profile/SAML2/Redirect/SSO
IDP3 Path : /idp/profile/SAML2/Redirect/SSO

Questions 

- Has anyone been in a similar situation and could advise if my solution is viable
- Has anyone updated IDP3 path to remove “idp”, is this best solution to investigate ? 
- Will I run into more issue using a reverse proxy ?

Any tips or advice would be great 

Cheers

Reid