SAML message intended destination endpoint did not match the recipient endpoint

[Brent Putman]

On 10/4/24 11:45 PM, Paul B. Henson via users wrote:
> I'm seeing a lot of these errors in my logs:
>
> 2024-10-04 02:13:01,274 - 20.77.36.136/node0188oi8w1gi31vq7p0mquln0785772 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:202] - Message Handler:  SAML message intended destination endpoint 'https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint'https://connectcpp.atriumcampus.com/idp/profile/SAML2/Redirect/SSO'
>
>
>
> <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> 		xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> 		ID="_ea0a81488bf0c951b92d6fdc654c2e9f51de2dec36"
> 		Version="2.0" IssueInstant="2024-10-04T09:12:58Z"
> 		Destination="https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO"
> 		AssertionConsumerServiceURL="https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/saml2-acs.php/connectcpp.atriumcampus.com"
> 		ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">  	<saml:Issuer>https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/metadata.php/connectcpp.atriumcampus.com</saml:Issuer>
> </samlp:AuthnRequest>
>
> I don't see the mismatch? The issuer exists in metadata, the ACS URL matches the metadata. What exactly is it complaining about? I can't reproduce it, when I try to log in, it works fine, with what looks like basically the same authn request?


In SAML the @Destination value in a protocol message indicates the URI 
at which the message must be received by the recipient. It's to prevent 
the message from being diverted by a malicious actor to another 
endpoint and being unwittingly processed to nefarious purposes.

In the AuthRequest, the Destination above says it must be delivered to 
"https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO".

The request at the IdP is actually seen by the IdP as coming into 
"https://connectcpp.atriumcampus.com/idp/profile/SAML2/Redirect/SSO". 
That 'recipient endpoint' in the log message is computed in the IdP 
from the web request info, i.e. what the web server is reporting to the 
IdP app. Essentially it's what's in the HttpServletRequest.

Possibly there is some intended virtual host stuff going on here, 
perhaps configured incorrectly.  But that is what the IdP "sees" as the 
actual delivered endpoint at which it is processing the request.

And since that doesn't match the message Destination value, that's the 
error.

--Brent
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241005/418c0e87/attachment.htm>