IdP v4 SAML Authentication Proxy Questions

[Nate Klingenstein]

All,

1)  Are unsolicited SSO requests supported?

I've got most of the SAML-based authentication flow working with a 4.0.1 IdP, but when an unsolicited SAML Response is returned to:

172.31.5.162 - - [05/Oct/2020:19:49:45 +0000] "POST /idp/profile/Authn/SAML2/POST/SSO HTTP/1.1" 200 1254

it blows up with:

2020-10-05 19:49:45,417 - 172.31.5.162 - ERROR [net.shibboleth.idp.authn.ExternalAuthenticationException:74] -
net.shibboleth.idp.authn.ExternalAuthenticationException: No RelayState parameter, unable to resume flow execution
        at net.shibboleth.idp.saml.saml2.profile.impl.SAMLAuthnController.finishSAML(SAMLAuthnController.java:201)

This shows up in the browser as the Stale Request error page.  If I add a RelayState, I get Webflow execution key errors.

2)  With solicited SSO, I'm able to be redirected to the secondary IdP, but the assertion that it issues back to the proxy is rejected.  There's not much logging to go by.  Even on TRACE, all I can get is:

2020-10-05 22:06:27,499 - 67.164.181.150 - INFO [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:331] - Profile Action ValidateAssertions: Assertion validation failure msg was: No subject confirmation methods were met for assertion with ID '_06f292908fdd7f33a8d0d241ab629fd7'
2020-10-05 22:06:27,506 - 67.164.181.150 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:218] - Profile Action ProcessAssertionsForAuthentication: Removing 1 non-valid Assertions from Response
2020-10-05 22:06:27,508 - 67.164.181.150 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:229] - Profile Action ProcessAssertionsForAuthentication: No valid SAML Assertions suitable for authentication were found
2

I'm using a single entityID for both pieces and the metadata loaded by the secondary IdP's is consistent with that.  Is there a way to get at least the assertion or some more information?  All providers in question are Shibboleth.

Thanks in advance,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id