<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Peter,
<div><br>
</div>
<div>I think we have made some progress. I now get an error from the SP after successful authentication rather than an error from IDP saying that it doesn't know how to talk to SP.</div>
<div><br>
</div>
<div>What I am now getting after successful login on the loginpage (UserPassword auth via LDAP) is the following from the SP:</div>
<div><span class="Apple-style-span" style="font-family: Geneva, Arial, Helvetica, sans-serif; ">
<p class="error" style="font-size: 10pt; margin-top: 20px; margin-bottom: 20px; font-weight: bold; ">
opensaml::FatalProfileException at (<a href="https://unixadmin.qatar-med.cornell.edu/Shibboleth.sso/SAML2/POST">https://unixadmin.qatar-med.cornell.edu/Shibboleth.sso/SAML2/POST</a>)</p>
<p style="font-size: 10pt; margin-top: 20px; margin-bottom: 20px; ">Unable to establish security of incoming assertion.</p>
</span>
<div>
<div>The shibd.log says:</div>
<div>
<div>2013-11-20 11:45:18 WARN Shibboleth.SSO.SAML2 [3]: detected a problem with assertion: Unable to establish security of incoming assertion.</div>
</div>
<div><br>
</div>
<div>The idp-process.log says:</div>
<div>
<div>11:45:17.730 - INFO [Shibboleth-Access:73] - 20131120T084517Z|207.162.244.209|idpt.qatar-med.cornell.edu:443|/profile/SAML2/Redirect/SSO|</div>
<div>11:45:17.766 - INFO [Shibboleth-Audit:1028] - 20131120T084517Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_8ac89e978b934d5ec1771ffea29681ef|https://unixadmin.qatar-med.cornell.edu|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://idpt.qatar-med.cornell.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_7eb3ab888531f740072f6ec8607f70cf|saa2012|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||_5359dddae06ba7c86cd49eb0196f7570||</div>
</div>
<div><br>
</div>
<div>I can provide any other information if it will help.</div>
<div>IDP: <a href="http://idpt.qatar-med.cornell.edu">idpt.qatar-med.cornell.edu</a></div>
<div>SP: <a href="http://unixadmin.qatar-med.cornell.edu">unixadmin.qatar-med.cornell.edu</a></div>
<div>Secure URL: <a href="https://unixadmin.qatar-med.cornell.edu/secure">https://unixadmin.qatar-med.cornell.edu/secure</a> (Apache, AuthType shibboleth)</div>
<div><br>
</div>
<div>Thanks!</div>
<div><br>
</div>
<div>Sam</div>
<div><br>
</div>
<div><br>
</div>
<div>On Nov 14, 2013, at 1:15 PM, Peter Schober wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div>* Sam Agnew <<a href="mailto:saa2012@qatar-med.cornell.edu">saa2012@qatar-med.cornell.edu</a>> [2013-11-14 10:33]:<br>
<blockquote type="cite">Error Message: No peer endpoint available to which to send SAML<br>
</blockquote>
<blockquote type="cite">response<br>
</blockquote>
<br>
The IdP does not have correct metadata for the SP (or the SP is<br>
misconfigured).<br>
<br>
<blockquote type="cite">12:23:30.805 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party 'https://unixadmin.qatar-med.cornell.edu/secure' requested the response to be returned to endpoint with ACS URL 'http://unixadmin.qatar-med.cornell.edu/Shibboleth.sso/SAML2/POST'
and binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, with that URL and using a supported binding, can be found in the relying party's metadata<br>
</blockquote>
<br>
That seems pretty clear, no?<br>
<br>
Above you have the entityID of the SP (which you for some reason set<br>
to "<a href="https://unixadmin.qatar-med.cornell.edu/secure">https://unixadmin.qatar-med.cornell.edu/secure</a>") and that contains<br>
an ACS URL referencing the SAML metadata <AssertionConsumerService><br>
element, or rather its "Location" XML attribute.<br>
<br>
So you now know what the IdP is looking for and you know that it<br>
cannot find something in all the metadata it has configured that<br>
matches these requirements.<br>
<br>
Why this is the case is for you to debug. You could post the metadata<br>
the IdP has on record for that SP, if needed.<br>
<br>
Personally I find it unusual (and would recommend against it) that the<br>
SP requests responses to be sent to plain http endpoints (instead of<br>
https). If the IdP has metadata with https URLs in them the SP is<br>
possibly misconfigured.<br>
<br>
<blockquote type="cite">2013-11-14 12:15:19 ERROR Shibboleth.ArtifactResolution.SAML2 [1]: error while processing request: Invalid content type for SOAP message.<br>
</blockquote>
<br>
Unrelated, but of course ERRORs and WARNs are never good. Why Artifact<br>
would play any role here is beyond me. Are you specifically trying to<br>
use Artifact, e.g. to make the SP work on plain http without<br>
generating security warnings from the browser?<br>
<br>
<blockquote type="cite">I have an inkling that this probably relates to the SP and IDP not<br>
</blockquote>
<blockquote type="cite">able to agree on how to handshake the success but I'm not able to<br>
</blockquote>
<blockquote type="cite">figure out how to resolve this.<br>
</blockquote>
<br>
I don't know what "how to handshake the success" means, but first and<br>
foremost the IdP does not have correct metadata for the SP.<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
</div>
<br>
<div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font-family: Helvetica; font-size: 12px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; "><br class="Apple-interchange-newline">
--</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font-family: Helvetica; font-size: 12px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">Sam Agnew</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font-family: Helvetica; font-size: 12px; ">
System Administrator</div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font-family: Helvetica; font-size: 12px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">IT Department</font></div>
<div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font-family: Helvetica; font-size: 12px; ">
<font face="Helvetica" size="3" style="font: normal normal normal 12px/normal Helvetica; ">Weill Cornell Medical College in Qatar</font></div>
<div style="font-family: Helvetica; font-size: 12px; "><br class="webkit-block-placeholder">
</div>
<br class="Apple-interchange-newline">
</div>
<br>
</div>
</body>
</html>