Validation problems with Proxied IDP (SAML flow)

[Mårtensson, Roger]

Hello all!

I'm trying to set up a Proxied IDP using the SAML flow but I'm hitting an error that I don't know how to solve.
I hope someone here has can tell me if I'm doing something wrong or point me in a direction where I could look for more information.

I've set up using this guide: https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+to+another+IdP

My environment. My proxy IDP is Shibboleth 4.1.0 (on Linux). The IDP that is used for login is my current test environment which is a Shibboleth 3.

Everything seems to work. Sort of.
When trying to logging in I'm redirected to my Shibboleth 4. Then I'm redirected to my Shibboleth 3 where  can login.
After login I'm redirected back to my proxy.

So far so good.

The problems starts after the Assertion is received by my proxy. It will not validate my Assertion.
Error message is: "No subject confirmation methods were met for assertion"

After enabling some debugging I see a more descriptive error:
"Failed to match SubjectConfirmationData/@Address to any supplied valid addresses: [/a.b.c.d]"

The assertion contains a <saml2:SubjectConfirmationData>" and when looking in the log I see that it confirms the issuer, confirms the audience, confirms the NotOnOrAfter and confirms the address which is the IP of the IDP that made the assertion.

Where it fails to validate (the error above) is on the IP  address (a.b.c.d) which is the IP of the system where my web browser is.

My computers IP# is not found in the <SubjectConfirmationData>.

What am I missing?

Is relaxing the validation of the <SubjectConfirmation> possible or advisable?

Yours,
Roger

Information about the processing of personal data at Mid Sweden University: www.miun.se/en/personaldata<http://www.miun.se/en/personaldata>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210415/06a641fa/attachment.htm>