<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Yu,
<div><br>
</div>
<div>Your SP is trying to communicate with your IdP directly on 8080, which shouldn't be a port that the IdP listens on in normal deployments anyway. I think you missed a step. Your IdP is also convinced that requests are coming in to the server name localhost,
which means you haven't virtualized your hosting environemtn properly.</div>
<div><br>
</div>
<div>You'll want to ensure your IdP listeners -- whether Apache Tomcat, Apache HTTPD, whatever -- are listening on 443(and optionally 8443), know their own names, and that your IdP metadata matches it(and it probably matches what it should be already).</div>
<div><br>
</div>
<div>Hope this helps,</div>
<div>Nate.</div>
<div><br>
<div>
<div>On Feb 16, 2014, at 7:42 AM, Yu Chen <<a href="mailto:cheny18@rpi.edu">cheny18@rpi.edu</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div>Hi, </div>
<div><br>
</div>
<div>I am trying to deploy shibboleth IDP and SP on a single virtual server inside a physical machine, whose address is
<a href="https://dcotest.tw.rpi.edu/">https://dcotest.tw.rpi.edu</a>. I followed the tutorial of installation and everything looks fine except going to
<a href="https://dcotest.tw.rpi.edu/secure">https://dcotest.tw.rpi.edu/secure</a>, where it says: Error Message: Message did not meet security requirements. And when I look into the log file of IDP, I found: </div>
<div><br>
</div>
00:52:38.111 - ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML message intended destination endpoint '<a href="https://dcotest.tw.rpi.edu/idp/profile/SAML2/Redirect/SSO'">https://dcotest.tw.rpi.edu/idp/profile/SAML2/Redirect/SSO'</a>
did not match the recipient endpoint '<a href="http://localhost:8080/idp/profile/SAML2/Redirect/SSO'">http://localhost:8080/idp/profile/SAML2/Redirect/SSO'</a>
<div><br>
</div>
<div>I found that there was someone else raising similar problems before, which is <a href="http://shibboleth.1660669.n2.nabble.com/SAML-message-intended-destination-endpoint-td6653987.html#a6654327">http://shibboleth.1660669.n2.nabble.com/SAML-message-intended-destination-endpoint-td6653987.html#a6654327</a>.
Someone suggest that to look into the IDP metadata to make sure there is no ‘localhost’ path, which I double checked my file and found none. </div>
<div><br>
</div>
<div>Can anyone help me on this? Is there anywhere else that IDP will somehow use localhost as the prefix? Thanks!</div>
<div><br>
</div>
<div>Cheers</div>
<div>Yu</div>
<div><br>
</div>
</div>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></blockquote>
</div>
<br>
</div>
</body>
</html>