<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">I’m at DEBUG for protocol, guess I should bump up the others and see what I get….<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">-Etan E. Weintraub<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Sr. Systems Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Directory Architecture<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">IT@Johns Hopkins<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Johns Hopkins at Mt. Washington<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">5801 Smith Ave.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Suite 3110B<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Baltimore, MD 21209<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Phone: 410-735-7945<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">E-mail: <a href="mailto:eweintra@jhmi.edu">
<span style="color:#1F497D">eweintra@jhmi.edu</span></a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Paul Hethmon<br>
<b>Sent:</b> Thursday, November 01, 2012 10:58 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: No Peer Endpoint - At a loss<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Does upping to debug level logging yield any other clues? Or even trace?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Paul<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Etan Weintraub <<a href="mailto:eweintra@jhmi.edu">eweintra@jhmi.edu</a>><br>
<b>Reply-To: </b>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Date: </b>Thursday, November 1, 2012 10:52 AM<br>
<b>To: </b>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject: </b>RE: No Peer Endpoint - At a loss<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Unfortunately, HTTP-POST isn’t a viable option in this scenario. HTTP-Redirect is the only one that works. If it was the response XML being too large, I would expect a different issue. This has to be a mismatch
somewhere, and I’m just not seeing what that is….</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">-Etan E. Weintraub</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Sr. Systems Engineer</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Directory Architecture</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">IT@Johns Hopkins</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Johns Hopkins at Mt. Washington</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">5801 Smith Ave.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Suite 3110B</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Baltimore, MD 21209</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Phone: 410-735-7945</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">E-mail: <a href="mailto:eweintra@jhmi.edu">
<span style="color:#1F497D">eweintra@jhmi.edu</span></a></span><span style="color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">
<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Paul Hethmon<br>
<b>Sent:</b> Thursday, November 01, 2012 10:50 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: No Peer Endpoint - At a loss</span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Putz. Missed that.</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Just a guess here, I always use the HTTP-POST binding to send the SAML Response back to the SP, could there be an issue with the size of the response XML causing Shib to fail?</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Paul</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Etan Weintraub <<a href="mailto:eweintra@jhmi.edu">eweintra@jhmi.edu</a>><br>
<b>Reply-To: </b>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Date: </b>Thursday, November 1, 2012 10:45 AM<br>
<b>To: </b>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject: </b>RE: No Peer Endpoint - At a loss<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Paul-</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Where do you see 1.1 for the endpoint (aside from in the protocol support enumeration, which has saml 2.0 first, and just supports the others, which I’ve also tried with just the 2.0 in that list).</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">-Etan E. Weintraub</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Sr. Systems Engineer</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Directory Architecture</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">IT@Johns Hopkins</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Johns Hopkins at Mt. Washington</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">5801 Smith Ave.</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Suite 3110B</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Baltimore, MD 21209</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Phone: 410-735-7945</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">E-mail: <a href="mailto:eweintra@jhmi.edu">
<span style="color:#1F497D">eweintra@jhmi.edu</span></a></span><span style="color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><span style="color:black"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black"><a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>
[<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>]<b>On Behalf Of
</b>Paul Hethmon<br>
<b>Sent:</b> Thursday, November 01, 2012 10:41 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: No Peer Endpoint - At a loss</span><span style="color:black"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">The AuthnRequest is SAML 2.0, metadata is 1.1 for the ACS endpoint.</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Paul</span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Etan Weintraub <<a href="mailto:eweintra@jhmi.edu">eweintra@jhmi.edu</a>><br>
<b>Reply-To: </b>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Date: </b>Thursday, November 1, 2012 10:36 AM<br>
<b>To: </b>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject: </b>No Peer Endpoint - At a loss<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:black">Hi All,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">So I’m at a bit of a loss here. I’m working on integrating a system that has its own SAML SP built in, and am getting the “No peer endpoint available to which to send SAML response” message. I added protocol debug
to my logs and have this:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">10:32:27.031 - DEBUG [PROTOCOL_MESSAGE:91] -
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="<a href="https://pfdev.isis.jhu.edu/NPStudent_PFSandbox/Logon.aspx">https://pfdev.isis.jhu.edu/NPStudent_PFSandbox/Logon.aspx</a>"
ID="mleklaicbkmclacdhegikepebmbaadbojljdondj" IsPassive="false" IssueInstant="2012-11-01T14:32:25Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" ProviderName="NetPartner" Version="2.0"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">NetPartner</saml:Issuer><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <samlp:NameIDPolicy AllowCreate="true"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"></samlp:AuthnRequest><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">10:32:41.010 - INFO [Shibboleth-Access:73] - 20121101T143241Z|10.186.64.218|shibpep.johnshopkins.edu:443|/profile/SAML2/Redirect/SSO|<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">10:32:41.014 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:397] - No return endpoint available for relying party NetPartner<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Here’s what I have for the metadata for that SP:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="NetPartner"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <md:AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://pfdev.isis.jhu.edu/NPStudent_PFSandbox/Logon.aspx">https://pfdev.isis.jhu.edu/NPStudent_PFSandbox/Logon.aspx</a>"
/> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> </md:SPSSODescriptor><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"></md:EntityDescriptor><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">As you can see, the ACS in the metadata and the one in the SAML request appear to match (at least to me). Anyone have any ideas what I missed/fat-fingered?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">-Etan E. Weintraub<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Sr. Systems Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Directory Architecture<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">IT@Johns Hopkins<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Johns Hopkins at Mt. Washington<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">5801 Smith Ave.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Suite 3110B<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Baltimore, MD 21209<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">Phone: 410-735-7945<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black">E-mail: <a href="mailto:eweintra@jhmi.edu">
<span style="color:windowtext">eweintra@jhmi.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>