<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 11/5/14 7:06 PM, Andrew Morgan
wrote:<br>
</div>
<blockquote
cite="mid:alpine.DEB.2.00.1411051546510.19015@shell.onid.oregonstate.edu"
type="cite">
<pre wrap="">On Wed, 5 Nov 2014, Cantor, Scott wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 11/5/14, 11:11 PM, "Andrew Morgan" <a class="moz-txt-link-rfc2396E" href="mailto:morgan@orst.edu"><morgan@orst.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:200] -
SAML message intended destination endpoint URI required by binding was
empty
</pre>
</blockquote>
<pre wrap="">
That's a missing Destination attribute, so...
</pre>
<blockquote type="cite">
<pre wrap="">Here is the working SAML from the prod instance:
</pre>
</blockquote>
<pre wrap="">
That is in fact not a working message. The one that worked had a
Destination attribute in the root element.
</pre>
</blockquote>
</blockquote>
<br>
<br>
Had to dig on this one.... Per the SAML 2 core and bindings specs,
the Destination is only required to be present if the message is
signed. So OpenSAML implements it that way: If the message is
signed it's an error for it to be absent; if it's unsigned then it's
optional. In both cases, when it is present, it must be valid or
else that's also an error.<br>
<br>
<br>
<br>
<blockquote
cite="mid:alpine.DEB.2.00.1411051546510.19015@shell.onid.oregonstate.edu"
type="cite">
<pre wrap="">
If you'd like to capture the SAML request yourself, here are the URLs:
beta (failing): <a class="moz-txt-link-freetext" href="https://oregonstate.beta.instructure.com/login">https://oregonstate.beta.instructure.com/login</a>
prod (working): <a class="moz-txt-link-freetext" href="https://oregonstate.instructure.com/login">https://oregonstate.instructure.com/login</a>
Both of them are missing the Destination attribute. I'm using IDP v2.4.0.
</pre>
</blockquote>
<br>
<br>
<br>
Yeah, looking at the raw protocol trace is the key here. The
difference is that in prod, they're not signing. In beta they are,
using of course the Redirect binding signature - which you don't see
in the XML, it's a query parameter. (In SAML Tracer, look on the
Parameters tab). So for the beta, the presence of the signature +
absence of Destination is causing the error. This is a bug on their
side, clear violation of the spec. They'll need to fix it, nothing
you can do about it from your end (except bug them).<br>
<br>
--Brent<br>
<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<br>
</body>
</html>