Ex: SAML message intended destination endpoint did not match the recipient endpoint

[Paul B. Henson]

> From: Paul B. Henson
> Sent: Friday, October 4, 2024 8:45 PM
> 
> I'm seeing a lot of these errors in my logs:

Here's another one:

2024-10-04 14:00:18,533 - 20.46.149.159/node019xst8p60ja0nl7bfm6ng9kkb569308 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:202] - Message Handler:  SAML message intended destination endpoint 'https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://streaming.cpp.edu/idp/profile/SAML2/Redirect/SSO'
2024-10-04 14:00:18,533 - 20.46.149.159/node019xst8p60ja0nl7bfm6ng9kkb569308 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:204] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: SAML message failed received endpoint check
        at org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler.checkEndpointURI(ReceivedEndpointSecurityHandler.java:204)
2024-10-04 14:00:18,534 - 20.46.149.159/node019xst8p60ja0nl7bfm6ng9kkb569308 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: MessageAuthenticationError

The matching request:

20.46.149.159 - - [04/Oct/2024:21:00:18 +0000] "GET /idp/profile/SAML2/Redirect/SSO?SAMLRequest=fVLJbsIwEP2VyH
ewEwIEC5AoqCoSLYjQHnqpjDMUS4mdeiZd%2Fr4GutBDuVnjt8x79hBVVdZy0tDeruGlAaTovSotyuPFiDXeSqfQoLSqApSkZT65XcikLWTtHT
ntSnZGucxQiODJOMui%2BWzEnnSSibQbJ0W3B2KrB3GnSJO%2Byga9rJNmopfFatvdKej2WfQAHgNzxIJQoCM2MLdIylIYiSRtxaIl0k0SSyFk
nD2yaBbSGKvoyNoT1Sg5N0Xd1nXdhqI5nHkIsTMl8MOOCV9DYTxo4nm%2BZNHke92ps9hU4HPwr0bD%2FXrxK4jkQVXGPv%2FINoHFVagULBmt
CFi0%2BqrqytgiQC%2B3tD2BUN5sNqvWaplv2Hh4KFceU%2Fvxv9ZDfg4bnh73LhjMZytXGv0RXTtfKbrsf5iYorU7QiV5ZdGEKKGPsnRv0%2B
BJMGLkG2B8fLL8%2B4XGnw%3D%3D&RelayState=%2Fmy-channels%3FsortBy%3Dmediacount%26amp%3Bmembership%3Dmember%26amp
%3Bkeyword%3D%2527 HTTP/1.1" 400 5415 "https://streaming.cpp.edu/my-channels?sortBy=mediacount&membership=
member&keyword=%27" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chro
me/126.0.0.0 Safari/537.36"

and the decoded SAML:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_c2804512d56e0bc913d427a89683480681ab5fae57" Version="2.0" IssueInstant="2024-10-04T21:00:18Z" Destination="https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO" AssertionConsumerServiceURL="https://streaming.cpp.edu/user/authenticate" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"><saml:Issuer>https://streaming.cpp.edu</saml:Issuer><samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" AllowCreate="true"/></samlp:AuthnRequest>

I don't understand why it's saying the recipient endpoint is the SP host instead of the idp host?