SubjectConfirmationData - incorrect recipient

[Alvin Leung]

Hi Scott,

Thanks for the fast reply.

This is the request message from the SP:

	<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
	AssertionConsumerServiceURL="https://.../Shibboleth.sso/SAML2/POST"
	Destination="https://..." ID="_8ebb4aa0dab8cb8c9a2f3321dde40f1d"
	IssueInstant="2017-02-03T04:04:58Z"
	ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
	Version="2.0">
	<saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">XXX</saml:Issuer>
	<samlp:NameIDPolicy AllowCreate="1"/></samlp:AuthnRequest>

This is the response from the IDP (as it appears on the SIGNATURE log):

	<Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_90bcaf40c57549d2a52edb253224ae0f" IssueInstant="2017-02-03T04:04:58Z"
Version="2.0">
	<Issuer>XXX</Issuer>
	<Subject>
	<NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:userPrincipalName">YYY</NameID>
	<SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
	<SubjectConfirmationData InResponseTo="_c160a8616c34860deb40236a96fd80e4"
NotOnOrAfter="2017-02-03T04:14:58Z"
Recipient="https://.../Shibboleth.sso/SAML2/POST"></SubjectConfirmationData>
	</SubjectConfirmation></Subject>
	<Conditions NotBefore="2017-02-03T03:59:58Z"
NotOnOrAfter="2017-02-03T04:14:58Z">
	<AudienceRestriction><Audience>XXX</Audience>
	</AudienceRestriction></Conditions>
	<AuthnStatement AuthnInstant="2017-02-03T04:04:58Z"><AuthnContext>
	<AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef>
	</AuthnContext></AuthnStatement><AttributeStatement>
	...
	</AttributeStatement></Assertion>

The IDP is not a Shibboleth installation – it is provided by a third party
commercial vendor.

The actual authentication appears to be occurring on the
https://.../Shibboleth.sso/SAML2/POST-SimpleSign URL so we believe that they
are using the SimpleSign encoding mechanism.

As I mentioned, we have gotten the integration working (when the IDP sent us
the Recipient URL as the POST-SimpleSign URL). When they send the Recipient
as the POST URL, Shibboleth rejects the message.

Does this further information assist?

Thanks.

Alvin

-----Original Message-----
From: Cantor, Scott [mailto:cantor.2 at osu.edu]
Sent: Tuesday, 7 February 2017 1:50 AM
To: Shib Users
Subject: RE: SubjectConfirmationData - incorrect recipient

> We suspect that the IDP is not configured correctly to send the right
> Recipient data – it should send the ‘Post-SimpleSign’ URL for the
> “Recipient”.

It should be using POST, I don't know how SimpleSign would ever come up in
this conversation.

> However, just to be sure, we wanted to check if the incorrect
> recipient data could be caused by anything on the SP side?

Depends on what the SP is requesting and how it's requesting it. Something
is deeply off here.

-- Scott