<div>I have some new information and hopefully will have access to the machines soon. It looks like the F1 load balancer is in front of the SP, not the IdP. Sorry about the wild goose chase. I will look closer at the SP configuration and try to spot the issue. Will also look into a more verbose log setting.</div>
<div> </div><div>Istvan<br><br></div><div class="gmail_quote">On Wed, Sep 12, 2012 at 10:00 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote"><div class="im">On 9/12/12 9:20 PM, "Istvan Gonzales" <<a href="mailto:istvangonzales@gmail.com">istvangonzales@gmail.com</a>> wrote:<br>
<br>
>I looked closer into my problem with SP not accepting an authn assertion<br>
>through the proxy. I decrypted the "good" assertion and the "bad"<br>
>assertion and I see no differences of substance in their content. Each<br>
>has an AttributeStatement and an AuthnStatement,<br>
> and only a session ID differs between the two AuthnStatements.<br>
<br>
</div>If you're still talking about the same error, the issue has absolutely<br>
nothing to do with SAML or your assertions. The web server(s) are simply<br>
not configured correctly and are not processing requests consistently with<br>
the URLs you intend them to be seeing. The external and internal views<br>
don't line up and that's not allowed.<br>
<br>
That's not at all unusual when a load balancer is involved, and it would<br>
be difficult or impossible to allow the SP to work for requests both<br>
through and around the load balancer because the web server can't know<br>
that that's happening. It has to handle requests based on the virtualized<br>
settings in use with the load balancer and that won't work for direct<br>
client access.<br>
<div class="im"><br>
><br>
>I also learned a tad bit more about the environment. This is an F5 proxy.<br>
>No DNS is setup yet. But this shouldn't matter as long as there is a host<br>
>entry on the test machine and if the default configuration uses front<br>
>channel binding. Does the SP contact<br>
> the IdP directly?<br>
<br>
</div>That depends on the profiles used, but it has nothing to do with the error<br>
in the subject.<br>
<br>
If you want to see how it's processing requests, turn up native.logger and<br>
see what the RequestMap is seeing. It will be off in some way in the cases<br>
that don't work.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>