Error: Unable to locate a SAML 2.0 ACS endpoint to use for response

[Peter Schober]

I'm not familiar with that error message myself, but looking at the
source code it seems to be this error is the result of using old and
not recommended configuration settings on the SP (acsByIndex) and a
mismatch between SP configurtion and the metadata the IDP has on
record for the SP.
Here's the relevant documentation:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator#NativeSPSessionInitiator-Attributes

Other, unrelated (to that specific error message) comments below:

* Alexander Ivanov <alex at calmforce.com> [2016-09-12 09:08]:
> I'm currently trying to integrate a newly set-up Shibboleth IdP with a
> Drupal site.  I'm following this guide, which provides sample
> configurations for configuring the SP:
> https://wiki.aai.niif.hu/index.php?title=DrupalShibbolethReadmeDev

So only the IDP is new, but the SP is old (preexisting configuration
and in use with other purposes)?

> I've made changes to my apache config file and shibboleth2.xml based on
> that guide.  Currently I'm stuck on the error below, which occurs when I
> attempt to login to the Drupal site via the IdP:
> *[mod_shib:error] Unable to locate a SAML 2.0 ACS endpoint to use for
> response.*

I'd start with a clean, default Shibboleth SP configuration and test
SSO using only the Shib SP, e.g.
https://sp.example.org/Shibboleth.sso/Login?entityID=<idp-entityID>&target=https://sp.example.org/Shibboleth.sso/Session
Only after that works and shows a successful session at the SP, with
the expected attributes sent by the IDP I'd consider modifying your
configuration further. (Not that I'd expect any changes for use with
Drupal that wouls sabotage the SP's functioning as SAML SP
implementation.)

Otherwise rollback the changes you made trying to use Drupal that
broke the SP and start again on a test system.

> I've attached my shibboleth2.xml and my
> /opt-shibboleth-idp/metadata/sp-metadata.xml
>  from the IdP config.  Do I need to modify my shibboleth2.xml file and add
> an <md:AssertionConsumerService element?  What config changes can I make to
> resolve this ACS endpoint error?

Those files are certainly weird and possibly hint at you arbitrarily
copy/pasting stuff from more several sources, which always is a
receipe for desaster.

>     <RequestMapper type="Native">
>         <RequestMap applicationId="default">
>             <Host name="stage.qdr.org">
>                 <Path name="Shibboleth.sso/Login" authType="shibboleth" requireSession="false" />
>             </Host>
>         </RequestMap>
>     </RequestMapper>

That's nonsensical and unneeded. The Shib SP will never block access
to its own endpoints.

>     <ApplicationDefaults entityID="https://stage.qdr.org/shibboleth" homeURL="https://stage.qdr.org/"
>         REMOTE_USER="eppn" attributePrefix="AJP_">

I thought you're trying to integrate with Drupal. Is there now a Java
servlet container in the mix, too? If not, why did you set that
attributePrefix?

>         <!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions -->
>         <Sessions lifetime="28800" timeout="3600" checkAddress="false"
>                   handlerURL="/Shibboleth.sso" handlerSSL="false"
>                   exportLocation="https://stage.qdr.org/Shibboleth.sso/GetAssertion"
>                   idpHistory="false" idpHistoryDays="7">

Why did you feel the need to change the URL for exportLocation? Do any
of applications or your own code even access the SAML assertion
directly?

>             <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Intranet"
>                               relayState="cookie" entityID="https://idp.stage.qdr.org/idp/shibboleth">
>                 <SessionInitiator type="SAML2" defaultACSIndex="1" template="bindingTemplate.html"/>
>                 <SessionInitiator type="Shib1" defaultACSIndex="5"/>
>             </SessionInitiator>
>             <!-- other things -->
>             <LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
>                 <LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
>                 <LogoutInitiator type="Local"/>
>             </LogoutInitiator>

How old is that Shibboleth SP (i.e., what version)? You shouldn't need
any of those settings with recent/current software.

>         <!-- Error pages to display to yourself if something goes horribly wrong. -->
>         <Errors supportContact="alex at localhost" logoLocation="/shibboleth-sp/logo.jpg"
>                 styleSheet="/shibboleth-sp/main.css"/>

Providing subjects that run into an error on your website with a
support email address of "something at localhost" is not going to be of
much help to them.

>     </md:Extensions>
>     <md:KeyDescriptor>
>       <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
>         <ds:X509Data>
>           <ds:X509SubjectName>O=Internet Widgits Pty Ltd,ST=Some-State,C=AU</ds:X509SubjectName>
>           <ds:X509Certificate>MIIDXTCCAkWgAwIBAgIJAIzVXOi9NQxfMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
> BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
> aWRnaXRzIFB0eSBMdGQwHhcNMTYwNTI0MTEwMTE2WhcNMTcwNTI0MTEwMTE2WjBF
> MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
> ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
> CgKCAQEA5RFYt02yC67v5d85+gYmqJroHoRguSxaPks4y8tZWm0Gx/L4tInFWT8s
> VEhONmMndGpA0hJSqF2pKSXy2gIxJOs4ts6b/1seOSROutwAe691ZGDYxTxqIzUe
> /Xuoar+oiyKa0ep1aeqUAvq25pRCaAYlIhEWsoftxU9WoGpJEVc2pFoiQYHn/ykN
> ZK+zzj2OAY8KOIKdZ4IHpj2ElfB1wUNuz41pWyTX06WTeHA02QIIteso2zBwbD8k
> sVRWw/0qxyDFQEMl8oMT0Y0cvhbckHbnD2DjRaVci2aem/PUUcXqNYxKiGQt/Kge
> K9bSPZnt+zT9BpT16cKsbT01+H/6AwIDAQABo1AwTjAdBgNVHQ4EFgQUylMS5uPd
> 2yfpmuES73oqepj2tiQwHwYDVR0jBBgwFoAUylMS5uPd2yfpmuES73oqepj2tiQw
> DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAZsbcyEaNINDLxziVmRx9
> PBn+gGz+0iwRdCZzvvOkDA2oox+SU7VatY4x7H8neQqyZoWGW5zgY8tatg1hL6GB
> HsJnd6msmt6Xd3FypGxW0tgDywdZ2ALui4cUk4OxNHhfX40VwFeYpqyh7e5tR7PW
> GHBGwlfdtrsvQ26f/iyHd8ebOaak6iRU8jCQO6uJ+3/bwzw8UoYYWSGN5zVn9PFB
> uSkZtuvpkziIKaEDAYbCNHxycu5N+1g+EJMnlEe/kQqldWxIf6FnfT1envWT5GH9
> 0dUwNsTYLVci8H7ZfC9thQrP6fCRiWOT5+lzj7DeakXmYvrBRhblGWfd7g2XTaVe
> hw==
> </ds:X509Certificate>

That's not a certificate created by the Shib SP installer/script (but
not a commercial one either, which is the only -- but usually still
wrong -- reason people change the cert). So why create a different
self-issued cert, esp. one which expires after only one year?
Looks like yet another change that doesn't make any sense.

-peter