<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Then I am confused. In the wiki it says:<div><span class="Apple-tab-span" style="white-space:pre"> </span>Inhibit the consistent address check by setting ensureConsistentClientAddress to false. </div><div><br></div><div>What I understand is that IdP will not check if the address specified in AuthnRequest message is the same as the real URL. After I set ensureConsistentClientAddress to false in IdPSessionFilter it did help to resolve the first error, then I am hitting a similar error reported from SL4JCleanupFilter.</div><div><br></div><div>If I understood incorrectly, could you please tell me what does it mean by setting ensureConsistentClientAddress to false?</div><div><br></div><div>I am just trying to achieve setting up a proxy in front of multiple IdP using session stickiness. Does current Shib IdP support it? If so how can I resolve the error that I am seeing? I mean:</div><div> <span class="Apple-style-span" style="font-family: monospace; ">SAML message intended destination endpoint '</span><span class="Apple-style-span" style="font-family: monospace; "><a href="http://sma-pc1:8080/idp/profile/SAML2/POST/SSO" target="_blank">http://sma-pc1:8080/idp/profile/SAML2/POST/SSO</a></span><span class="Apple-style-span" style="font-family: monospace; ">' did not match the recipient endpoint '</span><span class="Apple-style-span" style="font-family: monospace; "><a href="http://sma-pc1:8900/idp/profile/SAML2/POST/SSO" target="_blank">http://sma-pc1:8900/idp/profile/SAML2/POST/SSO</a></span><span class="Apple-style-span" style="font-family: monospace; ">'</span></div><div><font class="Apple-style-span" face="monospace"><br></font></div><div><font class="Apple-style-span" face="monospace">In the error, sma-pc1:8080 is the proxy URL, and sma-pc1:8900 is the real IdP URL.</font></div><div><font class="Apple-style-span" face="monospace"><br></font></div><div><font class="Apple-style-span" face="monospace"><br></font></div><div><font class="Apple-style-span" face="monospace">Thanks,</font></div><div><font class="Apple-style-span" face="monospace">Yaowen</font></div><div><font class="Apple-style-span" face="monospace"><br></font><div><div>On Sep 17, 2013, at 9:45 PM, Jim Fox wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><br>On Sep 17, 2013, at 6:58 PM, Cantor, Scott wrote:<br><br><blockquote type="cite">On 9/17/13 9:26 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">Looking at the last exception again, it seems coming from<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">IdPNoCacheFilter. It seems that I need to do the same thing for<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">IdPNoCacheFilter like I did for IdPSessionFilter and SL4JCleanupFilter to<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">disable the check. I don't have the environment. I will<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">try it tomorrow and see it the request goes through.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Those filters have nothing like the address checking that's in the session<br></blockquote><blockquote type="cite">filter.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">The proxying can't require that the URL checks fail, that can't be turned<br></blockquote><blockquote type="cite">off as far as I'm aware. I don't think the approach described by that<br></blockquote><blockquote type="cite">page, which was contributed by Jim Fox, requires that the checks be<br></blockquote><blockquote type="cite">disabled, so whatever you did is not equivalent.<br></blockquote><blockquote type="cite"><br></blockquote><br>The approach in question only required that <br><br> ensureConsistentClientAddress<br><br>be disabled. A DNS thing. Nothing else.<br><br>Jim<br><br><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Anyways, wiki needs to be updated since changing setting for<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">IdPSessionFilter only doesn't seems to be enough. Please let me know if I<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">am wrong.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">You are incorrect about the other filters being involved at least.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">-- Scott<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">--<br></blockquote><blockquote type="cite">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote><br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></div></blockquote></div><br></div></body></html>