Shibboleth Artifact Binding : Inbound message issuer was not authenticated

[Tom Scavo]

On Wed, Apr 25, 2018 at 4:26 AM, Indunil Rathnayake
<indunil.uom at gmail.com> wrote:
>
> Shibbolet is configured for SAML artifact binding and following error can be
> seen in logs, when processing the ArtifactResolve SOAP request...
>
> The issuer value of ArtifactResolve request, is same as the entityID of the
> SP metadata. What it meant by authenticating the issuer?

In this case, the SP issues an ArtifactResolve request directly to the
IdP. In order to complete the SAML exchange, the two parties
authenticate each other. In particular, the IdP authenticates the SP
before processing the ArtifactResolve request.

> and how it's done?

Authentication is done at the transport level (back-channel TLS) or
the document level (XML signature). In either case, there should be a
signing certificate in SP metadata. Is there?

Tom