Shibboleth integration issue with Google App

[Hong Ye]

Hi,

We are enabling Google SAML login with our Shibboleth IDP 3. I couldn’t figure out why I’m getting error "Unable to resolve outbound message endpoint".

In IDP log,
2016-07-25 12:08:23,695|128.253.101.159 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext:149] - Profile Action InitializeOutboundMessageContext: Initialized outbound message context
2016-07-25 12:08:23,696|128.253.101.159 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:369] - Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService for outbound message
2016-07-25 12:08:23,696|128.253.101.159 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:507] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest
2016-07-25 12:08:23,696|128.253.101.159 - WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:404] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint
2016-07-25 12:08:23,697|128.253.101.159 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: EndpointResolutionFailed

Authn Request from Google

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    ID="imecjbkopdlniklncaocaeklfdbbaefaaeijljjo"
                    Version="2.0"
                    IssueInstant="2016-07-25T15:59:30Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    ProviderName="google.com<http://google.com>"
                    IsPassive="false"
                    AssertionConsumerServiceURL="https://www.google.com/a/gmailtest.cornell.edu/acs"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">google.com<http://google.com></saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="true"
                        Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
                        />
</samlp:AuthnRequest>

Google metadata loaded in IDP
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="google.com<http://google.com>">

  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
      <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
      <AssertionConsumerService  Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
            Location="https://www.google.com/a/gmailtest.cornell.edu/acs" isDefault=“true" />
  </md:SPSSODescriptor>

</md:EntityDescriptor>

Thanks!
Hong
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160725/cc509572/attachment.html>