Issue with endpoint - "No return endpoint for relying party ...."

[Mark Watson]

I'm having an issue getting my HTTP-Redirect based SP correctly logging in
to TestShib. I'd previously had success but I'm scratching my head to
figure out what's changed. I'll include the raw AuthnRequest and Metadata
file at the end.

The error I'm receiving is:
edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:
No return endpoint available for relying party ...

=====================================================

Going through the three issues from
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTroubleshootingCommonErrors


   1.
   - Either there is no metadata (either filtered out or expired)

      I've uploaded fresh metadata as of today so it shouldn't be filtered
      out or expired. I received the "Your metadata was uploaded
successfully..."
      message from TestShib.

      - The metadata version does not match the service provider SAML
      request

      The metadata file defines:
      <md:SPSSODescriptor AuthnRequestsSigned="false"
      WantAssertionsSigned="false"
      protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

      The SP AuthnRequest defines:
      <saml2p:AuthnRequest AssertionConsumerServiceURL="
      http://myserver/sso/sp" Destination="
      https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
      ID="_0ec2d4169119606f16ca1f2ad312c115"
      IssueInstant="2017-01-18T23:24:42.029Z"
      ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
      Version="2.0"
      xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
      - The service provider is sending an assertion consumer index that
      the identity provider can't locate.

      The SP isn't sending an assertion consumer index.

      2. The IdP does not support the binding for the response endpoint
   requested by the service providers. For example if the SP requires the IdP
   send a response back by means of an artifact but the IdP does not support
   artifacts:

   From the TestShib metadata file:

   <SingleSignOnService
   Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
   https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"/>

   This matches the destination URL seen in the above AuthnRequest.

   3. A generalized case of the previous issue. The Service Provider does
   not specify a particular response endpoint, but the IdP does not support
   any of bindings listed in the service providers metadata.

   From the SP metadata:

   <md:AssertionConsumerService
   Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
   http://myserver/sso/sp" index="0" isDefault="true"/>


=====================================================

If anyone can lend a hand I'd really appreciate it. For a raw copy of the
AuthnRequest and SP Metadata minus identifying details:

SP Metadata:

<md:EntityDescriptor entityID="http://myserver/sso"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
  <md:SPSSODescriptor AuthnRequestsSigned="false"
WantAssertionsSigned="false"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate> ** Key Removed ** </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate> ** Key Removed ** </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>

<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="
http://myserver/sso/sp" index="0" isDefault="true"/>
  </md:SPSSODescriptor>
</md:EntityDescriptor>

AuthnRequest:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest
    AssertionConsumerServiceURL="http://myserver/sso/sp"
    Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
    ID="_0ec2d4169119606f16ca1f2ad312c115"
    IssueInstant="2017-01-18T23:24:42.029Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
    Version="2.0"
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
http://myserver/sso</saml2:Issuer>
    <saml2p:NameIDPolicy AllowCreate="true"
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
    <saml2p:RequestedAuthnContext Comparison="minimum">
        <saml2:AuthnContextClassRef
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
    </saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>

Thanks in advance!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170118/0628eda3/attachment-0001.html>