SAML message intended destination endpoint did not match the recipient endpoint

[Paul B. Henson]

I'm seeing a lot of these errors in my logs:

2024-10-04 02:13:01,274 - 20.77.36.136/node0188oi8w1gi31vq7p0mquln0785772 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:202] - Message Handler:  SAML message intended destination endpoint 'https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://connectcpp.atriumcampus.com/idp/profile/SAML2/Redirect/SSO'

When I look at the corresponding request though:

20.77.36.136 - - [04/Oct/2024:09:13:01 +0000] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=pZJfT8IwFMW%2FytJ31m1uZGuABOVBEgyEoQ%2B%2BmNJepMn6x97W%2BPHdQCO%2B4INPbW%2F7O%2Ffck06Q686xeQxHs4W3CBiSD90ZZKeLKYneMMtRITNcA7IgWDt%2FWLEizZjzNlhhO3KBXCc4IvigrCHJcjElL8AzXudlXe8PmWiqfN8UcnyQYlyVooDmUOUSCgniZkySJ%2FDYk1PSC%2FU4YoSlwcBN6EtZUY7ybJSVu6xhecGq%2Bpkki34aZXg4UccQHDJKlXSpcC4FGYc97Yc4qA7o4LGgW5DKgwi0bdckmX%2FbvbMGowbfgn9XAh63qx9BYY3piUGTB6%2BiFly7iKmwmiJaqq2MHaTu6OgQEMXzWoy4wFP1igBJNl8Z3yojlXm9Hu%2F%2B%2FAjZ%2FW63GW3W7Y7MJkMzdorLz%2F7hWUPgkgf%2Bl%2BUJvWx4Pv3%2BYLNP&RelayState=https%3A%2F%2Fconnectcpp.atriumcampus.com%2Flogin.php%3Fcid%3D389%26wason%3D%2Fstatementnew.php%26cid%3D389 HTTP/1.1" 400 5415 "https://connectcpp.atriumcampus.com/login.php?cid=389&wason=/statementnew.php&cid=389" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"

Which decodes to:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
		xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
		ID="_ea0a81488bf0c951b92d6fdc654c2e9f51de2dec36"
		Version="2.0" IssueInstant="2024-10-04T09:12:58Z"
		Destination="https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO"
		AssertionConsumerServiceURL="https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/saml2-acs.php/connectcpp.atriumcampus.com"
		ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">  	<saml:Issuer>https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/metadata.php/connectcpp.atriumcampus.com</saml:Issuer>
</samlp:AuthnRequest>

I don't see the mismatch? The issuer exists in metadata, the ACS URL matches the metadata. What exactly is it complaining about? I can't reproduce it, when I try to log in, it works fine, with what looks like basically the same authn request?

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                    ID="_39df61b25f46c62d67f51927fa4cd19deb66db5447"
                    Version="2.0"
                    IssueInstant="2024-10-05T03:35:34Z"
                    Destination="https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO"
		AssertionConsumerServiceURL="https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/saml2-acs.php/connectcpp.atriumcampus.com"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">
	<saml:Issuer>https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/metadata.php/connectcpp.atriumcampus.com</saml:Issuer>
</samlp:AuthnRequest>

What am I missing?

Thanks...

--
Paul B. Henson | Operating Systems and Network Analyst
henson at cpp.edu | California State Polytechnic University Pomona