<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12pt"><div>Hi,</div><div> My SP is sending a signed AuthnRequest, but at shibboleth IDP end, i see errors.</div><div>AuthnRequests that are not signed are working fine. Also signed Logout Requests seems to work fine.</div><div><br></div><div>I have taken care of the following settings before trying out signed AuthnRequest.</div><div>1) AuthnRequestsSigned="true" in SPSSODescriptor.</div><div>2) I also tried adding "<security:Rule xsi:type="security:MandatoryMessageAuthentication"/>" to "SAML2SSOSecurityPolicy" in relying-party.xml</div><div> </div><div>Here is the error from idp-process.log:</div><div>-------------------------------------</div><div> 17:26:38.627 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security
requirements</div><div> org.opensaml.xml.security.SecurityException: SAML message intended destination (required by binding) was not present</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>at org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder.checkEndpointURI(BaseSAMLMessageDecoder.java:201) ~[opensaml-2.6.0.jar:na]</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>at org.opensaml.saml2.binding.decoding.BaseSAML2MessageDecoder.decode(BaseSAML2MessageDecoder.java:72) ~[opensaml-2.6.0.jar:na]</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.decodeRequest(SSOProfileHandler.java:386) [shibboleth-identityprovider-2.4.0.jar:na]</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>at
edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.performAuthentication(SSOProfileHandler.java:211) [shibboleth-identityprovider-2.4.0.jar:na]</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:189) [shibboleth-identityprovider-2.4.0.jar:na]</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) [shibboleth-identityprovider-2.4.0.jar:na]</div><div> </div><div><br></div><div>Here is the signed AuthnRequest from IDP's idp-process.log:</div><div>-----------------------------------------------------------</div><div> <?xml version="1.0" encoding="UTF-8"?><saml2p:AuthnRequest xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="http://inw00003973:16006/ma/acs/knWkUYo8" ID="e7d83752-69ed-4b50-8125-6628a584e5fc" IssueInstant="2014-03-20T11:56:38.216Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"></div><div> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://knWkUYo8.inw00003973:16006</saml2:Issuer></div><div> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"></div><div> <ds:SignedInfo></div><div> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></div><div> <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/></div><div> <ds:Reference URI="#e7d83752-69ed-4b50-8125-6628a584e5fc"></div><div>
<ds:Transforms></div><div> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/></div><div> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></div><div> </ds:Transforms></div><div> <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/></div><div> <ds:DigestValue>Rl7TSyGsbyge/IsU3c6SCQpN7/s=</ds:DigestValue></div><div> </ds:Reference></div><div> </ds:SignedInfo></div><div>
<ds:SignatureValue>ePDcuSrQAu05J+uoPtpovnj587RKy+ivV7mXpRgi2pBk02KHNqU4PN7oGsyM/9MJR0ZnaA/SXUjHyVFxlcKLFWOe40U1v1iE48V3EzaaN3Xlzw9DUK+pLatXs09Yj5TlNSobiTW22rH5crasH2XzwxiJXzFwHAsGnRsn3HbLMfzzG5pkQ3+GZdRYDzwi/CGrLQGUuzlGH+37EJVYP/N07nqsi/MKRz4x0eOYB0GQZO9MaoFhRDJNec2tPVXnbf0IbsJpx2hzar8Ipa3mdCV+gFvJyhy9WPeGNiIObHAN7C2cZCECMqjGB1md49AmSxyoUiihDTa1y9VU60IRZJivzQ==</ds:SignatureValue></div><div> </ds:Signature></div><div> <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"/></div><div></saml2p:AuthnRequest></div><div><br></div><div>Any clues how this can be fixed?</div><div><br></div><div>Thanks,</div><div>Vasu</div></div></body></html>