Issue with Shibboleth SP - Endpoint Mismatch Error

[Paul B. Henson]

You redacted the log message. Is “FQDN.DOMAIN” exactly the same in both the destination and recipient endpoints? If so, this shouldn’t happen, as they do match.

If they are different, see the mailing list archives for a similar issue I asked about recently. That turned out to be a client using an invalid host header in the request.

On Oct 15, 2024, at 7:27 AM, Luan Trindade via users <users at shibboleth.net> wrote:


Hello, I’m having an issue with Shibboleth. I have a few SPs, and when I attempt to access the IdP through them, the following error is returned in the log:

"Message Handler: SAML message intended destination endpoint 'https://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO' did not match the recipient endpoint 'http://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO'"

I’m using Apache and Jetty (version 11.0.17).

Apache configuration file:
<VirtualHost *:80>
    ServerName FQDN.DOMAIN.br<http://FQDN.DOMAIN.br>

    CustomLog /var/log/apache2/dev.access.log combined
    ErrorLog /var/log/apache2/dev.error.log

    ProxyPreserveHost On
    Redirect permanent "/" "https://FQDN.DOMAIN.br/"

</VirtualHost>

<VirtualHost *:443>
    ServerName FQDN.DOMAIN.br<http://FQDN.DOMAIN.br>

    CustomLog /var/log/apache2/FQDN.access.log combined
    ErrorLog /var/log/apache2/FQDN.error.log

    SSLEngine On
    SSLCompression off
    SSLCACertificateFile /etc/ssl/certs/CER.pem
    SSLCertificateChainFile /etc/ssl/certs/CER.pem
    SSLCertificateKeyFile /etc/ssl/private/CER.key
    SSLCertificateFile /etc/ssl/certs/CER.cer

    ProxyPreserveHost On
    ProxyVia On
    ProxyRequests Off
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"
    RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
    ProxyPass /idp http://localhost:8080/idp
    ProxyPassReverse /idp http://localhost:8080/idp

</VirtualHost>

Jetty configuration file
[Unit]
Description=Jetty Web Server
After=network.target

[Service]
User=jetty
ExecStart=/usr/bin/java -jar /opt/jetty/start.jar jetty.http.port=8080 jetty.ssl.port=8443 --module=deploy,http,jsp,jstl,websocket,ext,resources
WorkingDirectory=/opt/jetty-base
Environment=JETTY_HOME=/opt/jetty
Environment=JETTY_BASE=/opt/jetty-base
Restart=on-failure

StandardOutput=append:/var/log/jetty/jetty.log
StandardError=append:/var/log/jetty/jetty_error.log

[Install]
WantedBy=multi-user.target

I have already checked the IdP metadata, and all the endpoints are using HTTPS. What could I do in this case? Thank you!

--
Luan Trindade
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241015/fa5a1d77/attachment.htm>