<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>I should add that this falls into the category of non-trivial deployment, and as such, you'll have to maintain a metadata file that describes the SP yourself and not rely on the built-in generator, if you were using that. You can certainly use what the generator spits out as a starting point, and you shouldn't need to change more than the AssertionConsumerService Location I referenced in the first email. Host it anywhere, or load it as a file.</div><br><div><div>On Sep 16, 2011, at 18:13 , Nate Klingenstein wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Terry,<div><br></div><div>For standard Shibboleth rather than CASShib, the endpoint as described in the metadata would be correct. The first one, in the request as generated by Shibboleth for CASShib I presume, may or may not be correct -- it's not our code nor our product. From a quick glance at their guide at:</div><div><br></div><div><a href="http://code.google.com/p/casshib/wiki/ShibbolethApacheTomcatInstallationAndConfigurationForCASShib">http://code.google.com/p/casshib/wiki/ShibbolethApacheTomcatInstallationAndConfigurationForCASShib</a></div><div><br></div><div>It would be the special Sessions element handlerURL described there that is causing the mismatch.</div><div><br></div><div>I don't have the spare cycles at this very moment to investigate how CASShib works in more detail, but you can try modifying the SP metadata as loaded by the IdP so that the AssertionConsumerService Location attribute matches that in the AuthnRequest, e.g. <a href="https://myunbtest.its.unb.ca/casshib/shib/myunb/Shibboleth.sso/SAML2/POST">https://myunbtest.its.unb.ca/casshib/shib/myunb/Shibboleth.sso/SAML2/POST</a>.</div><div><br></div><div><span class="Apple-style-span" style="font-family: Times; "><pre style="word-wrap: break-word; white-space: pre-wrap; "> <AssertionConsumerService index="1" isDefault="true"
Binding="<a href="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</a>"
Location="<a href="https://myunbtest.its.unb.ca/casshib/shib/myunb/Shibboleth.sso/SAML2/POST">https://myunbtest.its.unb.ca/casshib/shib/myunb/Shibboleth.sso/SAML2/POST</a>"/></pre></span></div><div><br></div><div>That will resolve the immediate complaint of the IdP. You may encounter other issues. If they're primarily related to CASShib, then you might try their mailing list at:</div><div><br></div><div><a href="http://groups.google.com/group/casshib">http://groups.google.com/group/casshib</a></div><div><br></div><div>How I wish I was in Sherbrooke now,</div><div>Nate.</div><div><br><div><div>On Sep 16, 2011, at 17:51 , Terry Soucy wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Heya,<br><br>We just installed our first IdP (latest version) and SP (again, latest<span class="Apple-converted-space"> </span><br>version in the yum repository) and are having some issues with the<span class="Apple-converted-space"> </span><br>CASShib module. We are able to auth to the IdP without error with<span class="Apple-converted-space"> </span><br>apache, but once we put CASShib into the mix, we get errors.<br><br>The assertion is telling the IdP that the endpoint is<span class="Apple-converted-space"> </span><br><a href="https://myunbtest.its.unb.ca/casshib/shib/myunb/Shibboleth.sso/SAML2/POST">https://myunbtest.its.unb.ca/casshib/shib/myunb/Shibboleth.sso/SAML2/POST</a>,<span class="Apple-converted-space"> </span><br>but the metadata says that the ACS is<span class="Apple-converted-space"> </span><br><a href="https://myunbtest.its.unb.ca/Shibboleth.sso/SAML2/POST">https://myunbtest.its.unb.ca/Shibboleth.sso/SAML2/POST</a>. We tried<span class="Apple-converted-space"> </span><br>modifying the handlerURL on the SP, but that doesn't update the metadata<span class="Apple-converted-space"> </span><br>information. What are we missing?<br></blockquote></div><br></div></div>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></body></html>