<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Is FF Firefox?<br>
<br>
When in SAML tracer the AuthnRequest has:<br>
<pre id="txt"><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL=<a class="moz-txt-link-rfc2396E" href="https://adfstest.com/sso/SAML2/POST">"https://adfstest.com/sso/SAML2/POST"</a>
Destination=<a class="moz-txt-link-rfc2396E" href="https://adfstest.com/adfs/ls/">"https://adfstest.com/adfs/ls/"</a>
.....
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a class="moz-txt-link-freetext" href="https://mysite.com/shibboleth">https://mysite.com/shibboleth</a></saml:Issuer>
So both AssertionConsumerServiceURL and Destination are pointed to the ADFS site and not my shibboleth site (which is the SP). The saml:Issuer does seem to be my site.
Does that mean my SP is configured incorrectly or is it the ADFS site?
</pre>
<br>
Thanks<br>
<br>
On 5/7/2012 8:51 AM, Paul Hethmon wrote:
<blockquote
cite="mid:CBCD6743.FB5E%25paul.hethmon@clareitysecurity.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<div>So that error is displayed by the ADFS IdP? If so, I would
say that ADFS is misconfigured.</div>
<div><br>
</div>
<div>I would suggest tracing the SAML flow with FF and SAML tracer
to make sure you are sending the correct Authn Request to the
IdP. Make sure that you are sending your entityID and not its
entityID, etc.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt;
text-align:left; color:black; BORDER-BOTTOM: medium none;
BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT:
0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid;
BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Brian Fox <<a
moz-do-not-send="true" href="mailto:dexwest@gmail.com">dexwest@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth
Users <<a moz-do-not-send="true"
href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Monday, May 7,
2012 11:47 AM<br>
<span style="font-weight:bold">To: </span>Shibboleth Users
<<a moz-do-not-send="true"
href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>ADFS Assertion
Consumer Service error<br>
</div>
<div><br>
</div>
<div>
<div bgcolor="#FFFFFF" text="#000000">I am trying to integrate
my Shibboleth SP with a ADFS site (as iDP). After the user
logins into AD site we see the following error:<br>
<pre wrap="">The request specified an Assertion Consumer Service URL '<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://adfstest.hyattidm.com/exterro.sso/SAML2/POST">https://adfstest.com/sso/SAML2/POST</a>' that is not configured on the relying party 'microsoft:identityserver:MYSP_ENTITYID'.
Based on my metadata my ACS endpoint is configured to:
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://mysite.com/sso/SAML2/POST">"https://mysite.com/sso/SAML2/POST"</a> index="0"/>
The ADFS system seems to be replacing my hostname with the ADFS server hostname. Any ideas how I can solve this?
I have been following the following howto:
</pre>
<h1 class="title" style="margin-top: 0px; margin-right: 0px;
margin-bottom: 20px; margin-left: 0px; font-family: 'Segoe
UI', Verdana, Arial; font-size: 20px; color: rgb(42, 42,
42); font-weight: normal; font-style: normal;
font-variant: normal; line-height: normal; letter-spacing:
normal; orphans: 2; text-align: left; text-indent: 0px;
text-transform: none; white-space: normal; widows: 2;
word-spacing: 0px; -webkit-text-size-adjust: auto;
-webkit-text-stroke-width: 0px; ">
AD FS 2.0 Step-by-Step Guide: Federation with Shibboleth 2
and the InCommon Federation</h1>
<pre wrap=""> <a moz-do-not-send="true" href="http://technet.microsoft.com/en-us/library/gg317734%28WS.10%29.aspx">http://technet.microsoft.com/en-us/library/gg317734(WS.10).aspx</a></pre>
Shibboleth version 2.4.3<br>
ADFS Windows Server 2008 R3<br>
<br>
</div>
</div>
</span>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
</body>
</html>