Ex: SAML message intended destination endpoint did not match the recipient endpoint

[Paul B. Henson]

On Sat, Oct 05, 2024 at 12:48:42AM -0400, Brent Putman wrote:

> I can't say in a detailed way, since I don't know anything about the
> environment, virtual host config, etc.  But the IdP is definitely
> seeing that the request is being processed at

Ah, you're saying that the client passed a Host header of
"connectcpp.atriumcampus.com" or "streaming.cpp.edu" in the request, and
that filtered down to the idp?

Hmm. That doesn't make any sense, there is no virtual hosting on these
boxes, they're dedicated to the idp. The box will accept whatever random
host header:

	curl -k -v --connect-to bogus.crap:443:idp.cpp.edu:443 https://bogus.crap/idp/shibboleth

but it still gets passed to the idp servlet.

There definitely isn't anything in DNS that would result in an end user
browser connecting to the ip address of idp.cpp.edu based on the name of
some random SP 8-/. In both examples the user agent was a regular
browser, unless somebody was lying about it. They'd have to be
overriding DNS on their local host or using a MITM proxy to futz with
the request in progress. But why?

Dunno. Either some client is being horribly broken or there's a weird
bug on the jetty/idp side. I haven't received any complaints regarding
users failing, so I guess for now I'll just ignore it <shrug>. Or I
suppose I could temporarily add the hostname field to the jetty access
log and see what it thinks it is for the failing requests.

Thanks for the info...


-- 
Paul B. Henson | Operating Systems and Network Analyst
henson at cpp.edu | California State Polytechnic University Pomona