SV: Validation problems with Proxied IDP (SAML flow)

[Mårtensson, Roger]

Hi and thanks!

My browser is not on the same server but I see your comment about what the SubjectConfirmation should contain and will look into how to solve that.
Will dive into our Load Balancer to see what I can do. I guess I'm just lucky to not have being bitten by this problem before.

I did find the checkAddress attribute but all my searches pointed me to the Shibboleth SP. 
That and that I thought that the SubjectConfirmation should contain the IDP-address in this proxy configuration. :/

I certainly hope and will try to make sure that I don’t need to implement checkAddress in my IDP. 

Anyway.. It seems I get another error now but it's still progress. 😊

Thanks again! 

-----Ursprungligt meddelande-----
Från: users <users-bounces at shibboleth.net> För Cantor, Scott
Skickat: den 15 april 2021 15:02
Till: Shib Users <users at shibboleth.net>
Ämne: Re: Validation problems with Proxied IDP (SAML flow)

The address in a bearer SubjectConfirmation block is never the IdP's address, it's the client's address. If it doesn't match, then you're either operating in a NAT'd, proxied, otherwise broken network, or you're making life hard by trying to test in some artifical way (e.g., running a browser on the same host as an IdP or proxy and ending up with localhost on one of the legs.

p:checkAddress="false" on the SAML2.SSO profile bean will disable the check, documented in the Javadocs and at [1].

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration#55804373d9264505e7b248218c3ea26c3fd35a11

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net