Understanding the cause of error related to parsing Issuer

[david.jones at equorum.com]

The Issuer appears in two locations in the response, initially as a child of the <samlp:Response> element it has:

<saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://customer-idp-server.com/metadata</saml:Issuer>

Then later in the xml hierarchy as a child of the <saml:Assertion> element is has:

<saml:Issuer Format=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://customer-idp-server.com/metadata</saml:Issuer>

I anonymized the server name here, but text search matches the strings exactly in each occurrence.  Could the change in the Format attribute make a difference?

-David

-----Original Message-----

>  I was hoping to get a better understanding of the following error and how to address it.  After being directed back to our SP (which is running Shibboleth) from the customer’s IdP, the user sees an error message:
>  opensaml::FatalProfileException at (https://server-running-shibboleth-sp.com/Shibboleth.sso/SAML2/POST)
> An Issuer was supplied that conflicts with previous results.

IIRC, that happens when you have a situation where the Response Issuer != the Assertion Issuer. I don't think I have ever encountered that in practice in 25 years.

Every time I think people can't implement SAML any more ridiculously, they teach me otherwise.

-- Scott