<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>That log message means that your SP sent the "http://george ..." URL in the SAML AuthnRequest sent to TestShib. Likely that means your SP is only running on http (and not https). The message about "no custom or group-based" means just that, you SP is being
processed using the default rules at TestShib (as opposed to special/specific ones).</div>
<div><br>
</div>
<div>The easiest thing to do would be to add the "http" endpoints to the metadata file you've uploaded to TestShib. Just list both "http" and "https". As long as both are listed, then both are valid. If you do want it to force SSL, then you'll need to consult
the Shib wiki on how to do that. I'm not positive what level that would be applied, whether Apache or Shib.</div>
<div><br>
</div>
<div>Also, use FireFox and download SAML Tracer. It will show all the headers being sent and un-encode and display the SAML XML. Very useful tool.</div>
<div><br>
</div>
<div>cheers,</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>George Boney <<a href="mailto:gcboney@bellsouth.net">gcboney@bellsouth.net</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Saturday, May 18, 2013 12:51 PM<br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Getting "No peer endpoint" on new installation<br>
</div>
<div><br>
</div>
<div>
<div text="#000000" bgcolor="#FFFFFF">Yes, I noticed that. But (and I may not understand how this works) the metadata file says "use https", but the reason it sends it to "http" is "No custom or group-based relying party configuration found"(from log). I
interpret this to mean it can't find "george.." in Metadata, so it used the default ("Using default relying party configuration" http) which doesn't work.<br>
<br>
I want it to use what is in the Meta file I uploaded (Plus I don't understand why it does not find the data I uploaded it --- or is that what a normal log file looks like?) Could I have an error in the Metadata file?<br>
<br>
Thanks,<br>
George<br>
<div class="moz-cite-prefix">On 5/17/2013 10:41 PM, Michael A Grady wrote:<br>
</div>
<blockquote cite="mid:57871934-0709-49A5-931A-34DCCA5AE10E@unicon.net" type="cite">
Note that the endpoint listed in those log entries for where the response is supposed to be sent is:
<div><br>
</div>
<div> <a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://george.rmtcentral.net/Shibboleth.sso/SAML2/POST">http://george.rmtcentral.net/Shibboleth.sso/SAML2/POST</a></div>
<div><br>
</div>
<div>but the endpoint corresponding to the SAML2 Post binding in the metadata entry is:</div>
<div><br>
</div>
<div> <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/Shibboleth.sso/SAML2/POST">https://george.rmtcentral.net/Shibboleth.sso/SAML2/POST</a></div>
<div><br>
</div>
<div>Note the difference -- one is http, one is https. The endpoint that is requested in the authn request does *not* match a registered endpoint in your metadata.</div>
<div><br>
<div>
<div>On May 17, 2013, at 8:19 PM, George Boney wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div text="#000000" bgcolor="#FFFFFF">Hello there,<br>
I have an issue I cannot seem to fix and I would appreciate any help you can provide. I am using Shibboleth on a CentOS system (the SP) and
<a moz-do-not-send="true" href="http://testshib.org">testshib.org</a> as the IDP. Here is basically what happens<br>
a) Try to access ‘secure’ page<br>
b) Presented with login – login as myself<br>
c) Get error “No Peer Endpoint”<br>
<br>
I am at a loss at what more I can do to debug this. It appears the IDP cannot find the system name in the metadata. I have reloaded the metadata a couple of times, and recopied Shibboleth2.xml, restart shib and http, etc. (Though the last few times the
Shibboleth2.xml has not had any changes in it.)<br>
<br>
Any help or suggestions about how to troubleshoot that you can provide would be appreciated.
<br>
<br>
<i>Low Priority: I also have a question about how to set this up so I can use different IDP’s for different URL (/secure/dir1/* goes to IDP-A, /secure/dir2/* goes to IDP-B). If you could recommend a good web source, white paper, book, etc. that discusses
this, I would appreciate it.</i><br>
Thanks,<br>
George Boney<br>
<br>
<b>Detailed Flow and description.</b><br>
Try to access URL “george.rmtcentral.net/secure/hello.cgi”<br>
(BTW, you can access “george.rmtcentral.net/unsecure/hello.cgi” just to see the expected result)<br>
It asks for a login (myself/myself) and then presents a page that says:<br>
-------------------------------------------------------------<br>
Something horrible happened. …<br>
Error Message: No peer endpoint available to which to send SAML response<br>
---------------------------------------------------------------<br>
<b>The log file says</b>:<br>
…<br>
20:26:39.906 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:170] - Incoming request contains a login context and indicates principal was authenticated, processing second leg of request<br>
20:26:39.907 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:128] - Looking up relying party configuration for
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://george.rmtcentral.net/shibboleth">
https://george.rmtcentral.net/shibboleth</a><br>
20:26:39.907 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:134] - No custom relying party configuration found for
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://george.rmtcentral.net/shibboleth">
https://george.rmtcentral.net/shibboleth</a>, looking up configuration based on metadata groups.<br>
20:26:39.908 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://george.rmtcentral.net/shibboleth">
https://george.rmtcentral.net/shibboleth</a>. Using default relying party configuration.<br>
20:26:39.909 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party '<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://george.rmtcentral.net/shibboleth">https://george.rmtcentral.net/shibboleth</a>' requested
the response to be returned to endpoint with ACS URL '<a moz-do-not-send="true" class="moz-txt-link-freetext" href="http://george.rmtcentral.net/Shibboleth.sso/SAML2/POST">http://george.rmtcentral.net/Shibboleth.sso/SAML2/POST</a>' and binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
however no endpoint, with that URL and using a supported binding, can be found in the relying party's metadata<br>
20:26:39.909 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:429] - No return endpoint available for relying party
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://george.rmtcentral.net/shibboleth">
https://george.rmtcentral.net/shibboleth</a><br>
<b>Metadata</b><br>
The metadata file (“Meda_George_Data.” Attached) shows<br>
<!--This is example metadata only. Do *NOT* supply it as is without review, and do *NOT* provide it in real time to your partners.--><br>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" ID="_19d9edf1851c00adc2a634793a1f9e536282b96c" entityID=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/shibboleth">"https://george.rmtcentral.net/shibboleth"</a>><br>
<md:Extensions xmlns:<br>
…. <br>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/Shibboleth.sso/SLO/Redirect">"https://george.rmtcentral.net/Shibboleth.sso/SLO/Redirect"</a>/><br>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/Shibboleth.sso/SLO/POST">"https://george.rmtcentral.net/Shibboleth.sso/SLO/POST"</a>/><br>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/Shibboleth.sso/SLO/Artifact">"https://george.rmtcentral.net/Shibboleth.sso/SLO/Artifact"</a>/><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/Shibboleth.sso/SAML2/POST">"https://george.rmtcentral.net/Shibboleth.sso/SAML2/POST"</a>
index="1"/><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/Shibboleth.sso/SAML2/POST-SimpleSign">"https://george.rmtcentral.net/Shibboleth.sso/SAML2/POST-SimpleSign"</a>
index="2"/><br>
…<br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="https://george.rmtcentral.net/Shibboleth.sso/SAML/Artifact">"https://george.rmtcentral.net/Shibboleth.sso/SAML/Artifact"</a>
index="6"/><br>
</md:SPSSODescriptor><br>
</md:EntityDescriptor><br>
<br>
</div>
<span><Meda_George_Data.html></span>--<br>
To unsubscribe from this list send an email to <a moz-do-not-send="true" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</div>
<br>
<div><span class="Apple-style-span" style="border-collapse:
separate; color: rgb(0, 0, 0); font-family: Helvetica;
font-style: normal; font-variant: normal; font-weight:
normal; letter-spacing: normal; line-height: normal;
orphans: 2; text-align: -webkit-auto; text-indent: 0px;
text-transform: none; white-space: normal; widows: 2;
word-spacing: 0px; -webkit-border-horizontal-spacing: 0px;
-webkit-border-vertical-spacing: 0px;
-webkit-text-decorations-in-effect: none;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width:
0px; font-size: medium; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0);
font-family: Helvetica; font-style: normal; font-variant:
normal; font-weight: normal; letter-spacing: normal;
line-height: normal; orphans: 2; text-align: -webkit-auto;
text-indent: 0px; text-transform: none; white-space:
normal; widows: 2; word-spacing: 0px;
-webkit-border-horizontal-spacing: 0px;
-webkit-border-vertical-spacing: 0px;
-webkit-text-decorations-in-effect: none;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width:
0px; font-size: medium; ">
<div style="word-wrap: break-word; -webkit-nbsp-mode:
space; -webkit-line-break: after-white-space; ">
<span class="Apple-style-span" style="border-collapse:
separate; color: rgb(0, 0, 0); font-family: Helvetica;
font-style: normal; font-variant: normal; font-weight:
normal; letter-spacing: normal; line-height: normal;
orphans: 2; text-align: -webkit-auto; text-indent:
0px; text-transform: none; white-space: normal;
widows: 2; word-spacing: 0px;
-webkit-border-horizontal-spacing: 0px;
-webkit-border-vertical-spacing: 0px;
-webkit-text-decorations-in-effect: none;
-webkit-text-size-adjust: auto;
-webkit-text-stroke-width: 0px; font-size: medium; ">
<div style="word-wrap: break-word; -webkit-nbsp-mode:
space; -webkit-line-break: after-white-space; ">
<div><br>
--<br>
Michael A. Grady<br>
Senior IAM Consultant, Unicon, Inc.</div>
</div>
</span></div>
</span></span></div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset> <br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
</div>
</div>
</span>
</body>
</html>