SP Binding Problems

[Michael Dahlberg]

My apologies for the continued requests for assistance, but this SP is
really challenging me.

My problem:  Login attempts to the SP, after authentication is processed
and attributes are resolved, results in the following error at the SP's web
site:

SAML2Err(mismatched REQUEST_METHOD)

This particular authentication request has the following header:

<samlp:AuthnRequest
    AssertionConsumerServiceURL="
https://bucknell.photoshelter.com/sso/SAML2/ACS/POST"
    Destination="https://shib.bucknell.edu/idp/profile/SAML2/Redirect/SSO"
    ID="ONELOGIN_9919935af4ea503d01822411f4b41c8d1e7e0b1b"
    IssueInstant="2017-06-28T12:49:16Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">

The HTTP-Redirect binding is one of our SingleSignOnServices.  Based on
this, I would surmise that the authentication request came in as a REDIRECT
and the response would be delivered as a POST.  The SAML response confirms
this:

<saml2p:Response
    Destination="https://bucknell.photoshelter.com/sso/SAML2/ACS/POST"
    ID="_9600068e403c47ffdc055b0777a7eb0a"
    InResponseTo="ONELOGIN_9919935af4ea503d01822411f4b41c8d1e7e0b1b"
    IssueInstant="2017-06-28T12:49:42.600Z" Version="2.0"
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xsd="
http://www.w3.org/2001/XMLSchema">

When I question the SP, they state that thats because the IdP is issuing a
GET request and that's whats causing the problem.  That seems wrong for
several different reasons:

(1) There are no backchannel services open on my IdP, so I doubt the IdP is
communicating directly with the SP.

(2) I know I don't fully understand the binding protocols involved but it
does not seem reasonable that an HTTP-POST, HTTP-POST-SimpleSign, or
HTTP-Redirect would submit the SAML Response as a HTTP GET command

Any suggestions for either where I went wrong and changes that might need
to be made or where the SP is wrong, would be greatly appreciated.

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170628/53a79172/attachment.html>