Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) :::

[Pruvost, Christian (ELS-OXF)]

Hi All,

I need a bit of help here. We have a working SAML2 Service Provider working hundreds of IDP, and everything works fine for the Regular SAML authentication. We have started working with a customer using AttributeQuery, and it has been rather tricky to get this to work. We have managed it in a test environment, and now moving this to a production environment where everything appears to be setup in a similar way (but obviously isn't) we are facing this error when submitting an atttributeQuery request: (This is a response from the IDP after we sent the attributeQuery Request to the appropriate Binding end-point https://idp.domain:9443/idp/attrsvc.ssaml2)

HTTP 500 error: (...) Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) :::

HTTP/1.1 500 Server Error
Date: Wed, 22 Nov 2017 11:02:31 GMT
Content-Security-Policy: referrer origin
Cache-Control: no-cache, no-store
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/xml;charset=utf-8
Set-Cookie: PF=CXKfmv8tWDIRA04uajbWlk;Path=/;Secure;HttpOnly
Transfer-Encoding: chunked

171
<S11:Envelope xmlns:S11="http://schemas.xmlsoap.org/soap/envelope/"><S11:Body><S11:Fault><faultcode xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">soapenv:Server</faultcode><faultstring>Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) ::: https://sdauth.sciencedirect.com/</faultstring></S11:Fault></S11:Body></S11:Envelope<https://sdauth.sciencedirect.com/%3c/faultstring%3e%3c/S11:Fault%3e%3c/S11:Body%3e%3c/S11:Envelope>>
0


The metadata extract we have for the partner IDP contains the following, so things seems to be in order at our end (on the SP side) in relation to our Relying Party and defining the appropriate Binding.
(...)
<md:AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
                <!--md:AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https:// idp.domain:9443/idp/attrsvc.ssaml2"/-->
                <md:AttributeService Location="https://idp.domain:9443/idp/attrsvc.ssaml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
                <md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat>
                <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
</md:AttributeAuthorityDescriptor>
(...)


Would anyone know if the 'Binding not enabled for (SP)...' issue is something that the IDP needs to configure for our SP, or if that is something potentially wrongly configured in our Service Provider.

Cheers,
Christian.
________________________________________________________
Christian Pruvost
Technical Product Manager




________________________________

Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171122/2f5005a0/attachment.html>