Ex: endpoint security handler error

[Paul B. Henson]

Is the authn request signed? Per the spec for POST,

"If the message is signed, the Destination XML attribute in the root SAML
element of the protocol message MUST contain the URL to which the sender has
instructed the user agent to deliver the message."


On Tue, Apr 23, 2024 at 05:20:19PM -0700, IAM David Bantz via users wrote:
> An SP request to my IdP is triggering this error upon processing the incoming request:
> 
> 15:16:40:803  ERROR [10.25.250.168] org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:174 >  Message Handler:  SAML message intended destination endpoint URI required by binding was empty
> 
> Here’s that request captured in SamlTracer
> 
> 
> <samlp:AuthnRequest ID=“•••"
> 
>                     Version="2.0"
> 
>                     IssueInstant="2024-04-23T23:28:33Z"
> 
>                     ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> 
>                     AssertionConsumerServiceURL="https://.../SAML2IdentityProviderSignin.aspx"
> 
>                     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> 
>                     >
> 
> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://sw-ualand-pa1.apps.ad.alaska.edu/landfolio</saml:Issuer>
> 
> <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
> 
>                     AllowCreate="true"
> 
>                     />
> 
> </samlp:AuthnRequest>
> 
> 
> and the ACS in that app’s metadata is
> 
> 
>         <md:AssertionConsumerService
> 
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST”
> 
> Location="https://.../SAML2IdentityProviderSignin.aspx" index=“1"
> 
> />
> 
> 
> Checked the ACS URLs do match exactly.
> 
> 
> What is wrong with that request+metadata combination ?
> 
> 
> David St Pierre Bantz
> 
> U Alaska IAM
> 
> CAUTION: This email was not sent from a Cal Poly Pomona service. Exercise caution when clicking links or opening attachments. Please forward suspicious email to suspectemail at cpp.edu<mailto:suspectemail at cpp.edu>.
> 

> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768