Ex: SAML message intended destination endpoint did not match the recipient endpoint

[Brent Putman]

On 10/7/24 9:48 PM, Paul B. Henson wrote:
>
> It seems some client is indeed providing the wrong host header 8-/.


Ok, thanks for confirming which of the 2 completely implausible 
scenarios is actually happening. :-)


>
> Interestingly, all of these failures since I enabled the extra logging come from a single IP address, 20.77.36.136, which is part of the Microsoft Azure cloud public address space...


Hmm, the front-channel request should be coming from a browser. I guess 
it could be some browser client being NATed from within that cloud 
env.  Or maybe it's something weirder.


>
> Dunno. In the end I think somebody somewhere is doing something stupid, but it has nothing to do with jetty or the idp.


Almost certainly it's something stupid, or some unusual ill-conceived 
testing setup that someone forgot to undo.

If you do ever figure the who/how/why of what is going on, I'd be 
interested to know.  This is definitely one of the weirder problem 
reports I can remember.

But yeah, nothing wrong with your deployment or the IdP code.  In fact, 
it's doing what it should, which is rejecting an invalid request.



>
> I guess I could set it up to reject invalid host headers, although various health checks and load balancer stuff talk to it using the IP address instead of the DNS name so I'd have to include those as well <sigh>.


Fwiw, I always setup my web servers to send requests with a Host header 
containing an unknown/unconfigured domain to a default vhost which 
displays an appropriate error to the user about either DNS or server 
misconfiguration. That prevents it from rendering content from whatever 
vhost it would otherwise pick, which is both confusing to the user and 
possibly insecure. That's in httpd. I don't know how to do in Jetty, 
but I imagine there's a way.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241009/a5302d8f/attachment.htm>