SubjectConfirmationData - incorrect recipient

[Alvin Leung]

Hi,



We have set up a Shibboleth SP with Apache 2.4 and Tomcat 8 on a Windows
Server and have successful integrated the SP with an external IDP on a test
server.



However after both we and our client deployed the configurations to a
preproduction server testing showed problems accessing the program.



When users access the URL for the first time on a browser they hit the
following error message:



                *Opensaml::FatalProfileException at
(https://.../Shibboleth.soo/SAML2/Post-SimpleSign
<https://.../Shibboleth.soo/SAML2/Post-SimpleSign>)*



*                Unable to locate satisfiable bearer SubjectConfirmation in
assertion*



If they attempted to access the same URL again, they were able to login
without any issues.



Reviewing the SIGNATURE DEBUG log files we identified that the user was
unable to login on first attempt because the SAML token had the following
“Recipient” attribute in the SubjectConfirmationData.



*<Recipient="https://.../Shibboleth.sso/SAML2/POST
<https://.../Shibboleth.sso/SAML2/POST>”> *



On the second attempt, the user was able to login and the SAML token had
the following “Recipient” attribute.



*<Recipient="https://.../Shibboleth.sso/SAML2/POST-SimpleSign
<https://.../Shibboleth.sso/SAML2/POST-SimpleSign>">*



We suspect that the IDP is not configured correctly to send the right
Recipient data – it should send the ‘Post-SimpleSign’ URL for the
“Recipient”.



However, just to be sure, we wanted to check if the incorrect recipient
data could be caused by anything on the SP side?



Is there anything that we can do as the SP to address this?



Many thanks.



Alvin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170206/df18ead6/attachment.html>