Integration with Zendesk SP

[Peter Schober]

* Hwei Chan <hwei at nextidea.co.nz> [2017-04-08 13:07]:
> Sorry, should have mentioned what I did try!

OK, sounds good, so far.

> The error I'm getting is:
> 
> 2017-04-08 11:00:18,043 - INFO
> [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:128]
> - Message Handler:  No metadata returned for
> https://xxxxxx.zendesk.com in role
> {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol
> urn:oasis:names:tc:SAML:2.0:protocol
>
> 2017-04-08 11:00:18,047 - WARN
> [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] -
> Profile Action SelectProfileConfiguration: Profile
> http://shibboleth.net/ns/profiles/saml2/sso/browser is not available
> for RP configuration shibboleth.UnverifiedRelyingParty (RPID
> https://xxxxxx.zendesk.com)

"No metadata returned" and "UnverifiedRelyingParty" means their
documentation is wrong, IMO. At least if you have configured their
SAML SP with an entityID of "xxxxxx.zendesk.com" (as I recall their
docs stating) but the request they send seems to come with an entityID
of "https://xxxxxx.zendesk.com", which is not the same thing (but
actually preferrable, as the latter is a valid URI).
So adjust your local metadata file to match the entityID from the
requests they send. That should take care of this.

> In the meantime, I'll try the NameID config and see if that makes a
> difference.

Sending NameIDs or not will not magically fix an "I don't have
metadata for an SP of this name" problem.

-peter