<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12-10-11 9:27 AM, Joost van Dijk
wrote:<br>
</div>
<blockquote
cite="mid:96528DB0-C76A-45E4-96A9-E249875FA789@surfnet.nl"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<base href="x-msg://4805/">
<div>Not sure if you already resolved your issues, but I believe
that the message in your log file:</div>
<div><br>
</div>
<div><span style="font-family: Calibri, sans-serif; font-size:
15px; ">No return endpoint available for relying party</span><span
class="apple-converted-space" style="font-family: Calibri,
sans-serif; font-size: 15px; "> </span><a
moz-do-not-send="true" href="urn:federation:MicrosoftOnline"
style="color: purple; font-family: Calibri, sans-serif;
font-size: 15px; ">urn:federation:MicrosoftOnline</a></div>
<div><br>
</div>
<div>has nothing to do with your setup but is related to an issue
with Office 365.</div>
<div>When a user connects to Microsoft's IMAP server, for example,
he/she sends a username and password for authentication that is
subsequently relayed to the user's IdP using the SAML ECP
profile. That is, a SOAP request is sent from Microsoft's
servers to your IdP's ECP endpoint (using HTTP Basic
authentication), e.g.</div>
<div><br>
</div>
<div>
<div><S:Envelope xmlns:S="<a moz-do-not-send="true"
href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"></div>
<div> <S:Body></div>
<div> <samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_73ffcfca-e08e-4a4c-88f5-2b8022c61bf2"
IssueInstant="2012-10-11T12:06:28.0084232Z" Version="2.0"
AssertionConsumerServiceIndex="2"></div>
<div>
<saml:Issuer>urn:federation:MicrosoftOnline</saml:Issuer></div>
<div> </samlp:AuthnRequest></div>
<div> </S:Body></div>
<div></S:Envelope></div>
</div>
<div><br>
</div>
<div>The problem is (I think) that there is no ACS URL with index
2 listed in Microsoft's Windows Azure AD metadata at</div>
<div><a moz-do-not-send="true"
href="https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml">https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml</a></div>
</blockquote>
<br>
In their example they have the following entry:<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<pre><AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location=<a class="moz-txt-link-rfc2396E" href="https://login.microsoftonline.com/login.srf">"https://login.microsoftonline.com/login.srf"</a> index="2" /></pre>
<a class="moz-txt-link-freetext" href="http://technet.microsoft.com/en-us/library/jj205463.aspx">http://technet.microsoft.com/en-us/library/jj205463.aspx</a><br>
<br>
Adding this in should fix the problem.<br>
<br>
</body>
</html>