IdP v5 external authentication error

[Martin Salvadori]

Paul, thanks for your response! Yes, I think the URL I configured in the SP
was incorrect.
However, the SP requires me to configure a URL to start the authentication
process. Reviewing the documentation, I thought the URL should be
https://<MY_NGROK_HOST>/idp/profile/authn/External,
but when using it, I get many errors like the following:
2025-03-17 18:23:53,704 - 0:0:0:0:0:0:0:1 - ERROR
[net.shibboleth.idp.authn:35] - Uncaught runtime exception
org.springframework.webflow.engine.FlowInputMappingException: Errors
occurred during input mapping on startup of the 'authn/External' flow;
errors = [[RequiredError at 1114f33f mapping = calledAsSubflow ->
flowScope.calledAsSubflow, code = 'required', error = true, errorCause =
[null], originalValue = [null], mappedValue = [null]]]
at org.springframework.webflow.engine.Flow.start(Flow.java:523)

I'm new to SAML. Could you please clarify which is the appropriate binding
I should use?

Thanks!

El lun, 17 mar 2025 a la(s) 5:23 p.m., Paul B. Henson (henson at acm.org)
escribió:

> On Mon, Mar 17, 2025 at 01:27:42PM -0300, Martin Salvadori via users wrote:
>
> > In Google Workspace (Google Admin console > Security > Authentication >
> SSO
> > with third-party IdP), I configured the IdP name and uploaded the signing
> > certificate generated during the IdP installation.
> > The URL of the sign-in page points to the JSP page that implements
> external
> > authentication: https://<MY_NGROK_HOST>/idp/external.jsp
>
> You're pointing the SAML SP directly to your custom external auth page?
> That's not right; the SP should send an auth request to the idp using
> the appropriate binding as usual, the idp will then redirect to the
> external auth page as part of handing the auth request.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250317/95458d61/attachment.htm>