Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) :::

[Tom Scavo]

On Wed, Nov 22, 2017 at 9:32 AM, Pruvost, Christian (ELS-OXF)
<c.pruvost at elsevier.com> wrote:
> Yes, that's what I mean. But I think the answer I received directly clearly point to what I suspected.
> A misconfiguration in SP metadata for that IDP  or the IDP not being configured for such binding with our SP...

The latter is very likely in my experience. IdPs routinely publish
AttributeService endpoints (and other back-channel endpoints) that are
untested and in some cases obviously broken.

Since SP metadata does not indicate whether the SP is willing or able
to send an AttributeQuery, SP metadata is not the issue here. The only
thing you need in metadata is a signing key, which is used by your
SOAP client to authenticate to the IdP.

> (...)
> as the error message says, the IdP doesn't have a SOAP endpoint location for the SP -  check your SP metadata etc to ensure
> you have one existing and then ensure that the IdP has that line entry for your SP entity - this will have to be done for every IdP (which is
> where federations come in useful as you just update your metadata in the main metadata file and all IdPs get updated
> (...)

That makes no sense.

Tom