RequesterID error on Azure/Shib IdP integration

[Dave Perry]

Scott

Thanks for the signpost. I have added the following to relying-party.xml:

            <!--365: stop RequesterID errors on Azure side-->           
            <bean parent="RelyingPartyByName" c:relyingPartyIds="medialoans.yorksj.ac.uk">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:ignoreScoping="true" />
                </list>
            </property>
        </bean>

But it hasn't worked. According to my debug (all levels) log file, it is showing as catching the need to do something - but not that it should actually do anything:
      Line 43067: 2024-03-04 15:14:09,782 - 10.4.105.22 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:131] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer medialoans.yorksj.ac.uk
      Line 43071: 2024-03-04 15:14:09,782 - 10.4.105.22 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:265] - Checking if relying party configuration EntityNames[medialoans.yorksj.ac.uk,] is applicable
      Line 43072: 2024-03-04 15:14:09,782 - 10.4.105.22 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:267] - Relying party configuration EntityNames[medialoans.yorksj.ac.uk,] is applicable
      Line 43073: 2024-03-04 15:14:09,782 - 10.4.105.22 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:174] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration EntityNames[medialoans.yorksj.ac.uk,] for request
      Line 43094: 2024-03-04 15:14:09,922 - 10.4.105.22 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:452] - Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at location https://medialoans.yorksj.ac.uk/SAML/AssertionConsumerService using binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
      Line 43129: 2024-03-04 15:14:10,328 - 10.4.105.22 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:265] - Checking if relying party configuration EntityNames[medialoans.yorksj.ac.uk,] is applicable
      Line 43130: 2024-03-04 15:14:10,328 - 10.4.105.22 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:270] - Relying party configuration EntityNames[medialoans.yorksj.ac.uk,] is not applicable

I can't find an obvious what I'm doing wrong here (and I know it was trying to look at it before, as my first attempt was ignoreScorping and it suggested I meant ignoreScoping.

I think, from my reading, that's the right way of doing this?

I have however flagged with the supplier, that there is technically a bug in their SAML engine - no idea if they'll listen or not (if anyone from Lorensberg is on this list, please listen!).


Thanks
Dave

_________________________________________________

Dave Perry
Application Analyst  |  Innovation & Technology Services

York St John University

Lord Mayor’s Walk, York, YO31 7EX
T: +44(0)1904 876 0000
d.perry1 at yorksj.ac.uk<mailto:d.perry1 at yorksj.ac.uk>  |  www.yorksj.ac.uk<http://www.yorksj.ac.uk/>

[cid:aff4ea40-ccfb-4438-b050-26d40ea33fb0]

________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: 04 March 2024 13:27
To: Shib Users <users at shibboleth.net>
Cc: Dave Perry <d.perry1 at yorksj.ac.uk>
Subject: Re: RequesterID error on Azure/Shib IdP integration

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.


> Is this something I can suppress somewhere in the IdP?

Answered on the list several times.

https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP4%2Fpages%2F1282539600%2FSAMLAuthnConfiguration%23Advanced-Behavior&data=05%7C02%7Cd.perry1%40yorksj.ac.uk%7C343b2d8e9d9b4a6e31a308dc3c4eecda%7C5c8ae38ef85b4309b7ec862815a37aee%7C0%7C0%7C638451556884987527%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=rC0Oy%2FJRfa4CXeFqU%2FGP97vq9L8sgwQBM4cRY7HZtyk%3D&reserved=0<https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration#Advanced-Behavior>

"A Note about Azure".

Whether you choose to accept a buggy SP or not is a decision you have to make, but this is what happens when you do.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240304/c4483a47/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-3vzrvkmy.png
Type: image/png
Size: 12155 bytes
Desc: Outlook-3vzrvkmy.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240304/c4483a47/attachment.png>