<div dir="ltr">I&#39;m currently trying to connect a SAML 1.1 based IdP (Jasig CAS) to our existing Shibboleth 2.5 SP and having some issues with configuration on the SP side.  Any help or pointers to the correct docs is greatly appreciated.<div><br></div><div>tl;dr Is it possible to configure a Shibboleth SP to accept SAML 1.1 Artifact based logins where the Issuer is not the address of the IdP server?</div><div><br></div><div><br></div><div><br></div><div>I am using <font face="monospace"><a href="https://my-sp">https://my-sp</a> </font><font face="verdana, sans-serif">in place of my actual SP server address for all examples.  </font><font face="monospace"><a href="https://localhost:8443">https://localhost:8443</a></font><font face="verdana, sans-serif"> is the correct address for the IdP, as I am running a development server to test against at the moment.</font></div><div><br></div><div>The Idp is initiating SSO via Browser Artifact with a url of the form:</div><div><font face="monospace">      <a href="https://localhost:8443/cas/login?TARGET=https://my-sp/Shibboleth.sso/SAML/Artifact">https://localhost:8443/cas/login?TARGET=https://my-sp/Shibboleth.sso/SAML/Artifact</a></font></div><div><div><br></div><div><br></div><div>I have written a metadata file for the SAML1.1 IdP as follows:</div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><div><font face="monospace">&lt;EntityDescriptor validUntil=&quot;2020-01-01T00:00:00Z&quot; entityID=&quot;<a href="https://localhost:8443">https://localhost:8443</a>&quot;&gt;</font></div></div></div><div><div><div><font face="monospace">    &lt;IDPSSODescriptor protocolSupportEnumeration=&quot;urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol&quot;&gt;</font></div></div></div><div><div><div><font face="monospace">        &lt;KeyDescriptor&gt;</font></div></div></div><div><div><div><font face="monospace">              &lt;!-- SNIP --&gt;</font></div></div></div><div><div><div><font face="monospace">        &lt;/KeyDescriptor&gt;</font></div></div></div><div><div><div><font face="monospace"><br></font></div></div></div><div><div><div><font face="monospace">        &lt;ArtifactResolutionService index=&quot;1&quot;</font></div></div></div><div><div><div><font face="monospace">            Binding=&quot;urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding&quot;</font></div></div></div><div><div><div><font face="monospace">            Location=&quot;<a href="https://localhost:8443/cas/samlValidate?TARGET=https://my-sp/Shibboleth.sso/SAML/Artifact">https://localhost:8443/cas/samlValidate?TARGET=https://my-sp/Shibboleth.sso/SAML/Artifact</a>&quot;/&gt;</font></div></div></div><div><div><div><font face="monospace"><br></font></div></div></div><div><div><div><font face="monospace">        &lt;NameIDFormat&gt;urn:mace:shibboleth:1.0:nameIdentifier&lt;/NameIDFormat&gt;</font></div></div></div><div><div><div><font face="monospace"><br></font></div></div></div><div><div><div><font face="monospace">        &lt;!-- snip --&gt;</font></div></div></div><div><div><div><font face="monospace"><br></font></div></div></div><div><div><div><font face="monospace">    &lt;/IDPSSODescriptor&gt;</font></div></div></div><div><div><div><font face="monospace">&lt;/EntityDescriptor&gt;</font></div></div></div></blockquote><div><div><div><div><br></div><div><br></div><div>If the entityID is of the form &quot;<font face="monospace"><a href="https://localhost:8443">https://localhost:8443</a></font>&quot;, then It will correctly match the metadata to the artifact and successfully complete the SOAP artifact resolution and return a SAML assertion such as:</div></div></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><font face="monospace">&lt;?xml version=&quot;1.0&quot;?&gt;</font></div></div><div><div><font face="monospace">&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV=&quot;<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>&quot;&gt;</font></div></div><div><div><font face="monospace">  &lt;SOAP-ENV:Body&gt;</font></div></div><div><div><font face="monospace">    &lt;saml1p:Response xmlns:saml1p=&quot;urn:oasis:names:tc:SAML:1.0:protocol&quot; IssueInstant=&quot;2014-11-25T09:20:46.857Z&quot; MajorVersion=&quot;1&quot; MinorVersion=&quot;1&quot; Recipient=&quot;<a href="https://my-sp/Shibboleth.sso/SAML/Artifact">https://my-sp/Shibboleth.sso/SAML/Artifact</a>&quot; ResponseID=&quot;_b8c3e1fc01d31c8b40454ba9d50174ab&quot;&gt;</font></div></div><div><div><font face="monospace">      &lt;saml1p:Status&gt;</font></div></div><div><div><font face="monospace">        &lt;saml1p:StatusCode Value=&quot;saml1p:Success&quot;/&gt;</font></div></div><div><div><font face="monospace">      &lt;/saml1p:Status&gt;</font></div></div><div><div><font face="monospace">      &lt;saml1:Assertion xmlns:saml1=&quot;urn:oasis:names:tc:SAML:1.0:assertion&quot; AssertionID=&quot;_86624c275508dd631176992019173f52&quot; IssueInstant=&quot;2014-11-25T09:20:46.857Z&quot; Issuer=&quot;localhost&quot; MajorVersion=&quot;1&quot; MinorVersion=&quot;1&quot;&gt;</font></div></div><div><div><font face="monospace">        &lt;saml1:Conditions NotBefore=&quot;2014-11-25T09:20:46.857Z&quot; NotOnOrAfter=&quot;2014-11-25T09:21:16.857Z&quot;&gt;</font></div></div><div><div><font face="monospace">          &lt;saml1:AudienceRestrictionCondition&gt;</font></div></div><div><div><font face="monospace">            &lt;saml1:Audience&gt;<a href="https://my-sp/Shibboleth.sso/SAML/Artifact">https://my-sp/Shibboleth.sso/SAML/Artifact</a>&lt;/saml1:Audience&gt;</font></div></div><div><div><font face="monospace">          &lt;/saml1:AudienceRestrictionCondition&gt;</font></div></div><div><div><font face="monospace">        &lt;/saml1:Conditions&gt;</font></div></div><div><div><font face="monospace">        &lt;saml1:AuthenticationStatement AuthenticationInstant=&quot;2014-11-25T09:20:45.819Z&quot; AuthenticationMethod=&quot;urn:oasis:names:tc:SAML:1.0:am:unspecified&quot;&gt;</font></div></div><div><div><font face="monospace">          &lt;saml1:Subject&gt;</font></div></div><div><div><font face="monospace">            &lt;saml1:NameIdentifier&gt;casuser&lt;/saml1:NameIdentifier&gt;</font></div></div><div><div><font face="monospace">            &lt;saml1:SubjectConfirmation&gt;</font></div></div><div><div><font face="monospace">              &lt;saml1:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:artifact&lt;/saml1:ConfirmationMethod&gt;</font></div></div><div><div><font face="monospace">            &lt;/saml1:SubjectConfirmation&gt;</font></div></div><div><div><font face="monospace">          &lt;/saml1:Subject&gt;</font></div></div><div><div><font face="monospace">        &lt;/saml1:AuthenticationStatement&gt;</font></div></div><div><div><font face="monospace">      &lt;/saml1:Assertion&gt;</font></div></div><div><div><font face="monospace">    &lt;/saml1p:Response&gt;</font></div></div><div><div><font face="monospace">  &lt;/SOAP-ENV:Body&gt;</font></div></div><div><div><font face="monospace">&lt;/SOAP-ENV:Envelope&gt;</font></div></div></blockquote><div><br></div><div>As you can see in the above assertion, the issuer is &quot;localhost&quot;.  This does not match the entityID, and the login will be rejected with an error message of:</div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font face="monospace">2014-11-26 04:50:39 DEBUG XMLTooling.SOAPClient [2]: received XML:</font></div></div><div><div><font face="monospace">&lt;SOAP-ENV:Envelope xmlns:SOAP-ENV=&quot;<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>&quot;&gt;&lt;SOAP-ENV:Body&gt;&lt;saml1p:Response xmlns:saml1p=&quot;urn:oasis:names:tc:SAML:1.0:protocol&quot; IssueInstant=&quot;2014-11-26T04:49:55.453Z&quot; MajorVersion=&quot;1&quot; MinorVersion=&quot;1&quot; Recipient=&quot;<a href="https://my-sp/Shibboleth.sso/SAML/Artifact">https://my-sp/Shibboleth.sso/SAML/Artifact</a>&quot; ResponseID=&quot;_5c4ff68cb15ae64e0114e44c36ed27ab&quot;&gt;&lt;saml1p:Status&gt;&lt;saml1p:StatusCode Value=&quot;saml1p:Success&quot;/&gt;&lt;/saml1p:Status&gt;&lt;saml1:Assertion xmlns:saml1=&quot;urn:oasis:names:tc:SAML:1.0:assertion&quot; AssertionID=&quot;_8f6ef07740a898cfe6a8086505d1b5d5&quot; IssueInstant=&quot;2014-11-26T04:49:55.453Z&quot; Issuer=&quot;localhost&quot; MajorVersion=&quot;1&quot; MinorVersion=&quot;1&quot;&gt;&lt;saml1:Conditions NotBefore=&quot;2014-11-26T04:49:55.453Z&quot; NotOnOrAfter=&quot;2014-11-26T04:50:25.453Z&quot;&gt;&lt;saml1:AudienceRestrictionCondition&gt;&lt;saml1:Audience&gt;<a href="https://my-sp/Shibboleth.sso/SAML/Artifact">https://my-sp/Shibboleth.sso/SAML/Artifact</a>&lt;/saml1:Audience&gt;&lt;/saml1:AudienceRestrictionCondition&gt;&lt;/saml1:Conditions&gt;&lt;saml1:AuthenticationStatement AuthenticationInstant=&quot;2014-11-26T04:49:54.460Z&quot; AuthenticationMethod=&quot;urn:oasis:names:tc:SAML:1.0:am:unspecified&quot;&gt;&lt;saml1:Subject&gt;&lt;saml1:NameIdentifier&gt;casuser&lt;/saml1:NameIdentifier&gt;&lt;saml1:SubjectConfirmation&gt;&lt;saml1:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:artifact&lt;/saml1:ConfirmationMethod&gt;&lt;/saml1:SubjectConfirmation&gt;&lt;/saml1:Subject&gt;&lt;/saml1:AuthenticationStatement&gt;&lt;/saml1:Assertion&gt;&lt;/saml1p:Response&gt;&lt;/SOAP-ENV:Body&gt;&lt;/SOAP-ENV:Envelope&gt;</font></div></div><div><div><font face="monospace">2014-11-26 04:50:39 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [2]: evaluating message flow policy (replay checking on, expiration 60)</font></div></div><div><div><font face="monospace">2014-11-26 04:50:39 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [2]: evaluating message flow policy (replay checking on, expiration 60)</font></div></div><div><div><font face="monospace">2014-11-26 04:50:39 DEBUG XMLTooling.StorageService [2]: inserted record (_5c4ff68cb15ae64e0114e44c36ed27ab) in context (MessageFlow) with expiration (1416977635)</font></div></div><div><div><font face="monospace">2014-11-26 04:50:39 DEBUG Shibboleth.SSO.SAML1 [2]: processing message against SAML 1.x SSO profile</font></div></div><div><div><font face="monospace">2014-11-26 04:50:39 DEBUG Shibboleth.SSO.SAML1 [2]: extracting issuer from SAML 1.x assertion</font></div></div><div><div><font face="monospace">2014-11-26 04:50:39 WARN Shibboleth.SSO.SAML1 [2]: detected a problem with assertion: An Issuer was supplied that conflicts with previous results.</font></div></div></blockquote><div><br></div><div>If I change the entityID in the metadata above to be &quot;localhost&quot; (the same as the issuer), then the login will fail immediatly after getting the artifact with an error message of:</div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><font face="monospace">2014-11-26 21:16:07 DEBUG OpenSAML.MessageDecoder.SAML1Artifact [1]: attempting to determine source of artifact(s)...</font></div></div><div><div><font face="monospace">2014-11-26 21:16:07 ERROR OpenSAML.MessageDecoder.SAML1Artifact [1]: metadata lookup failed, unable to determine issuer of artifact (0x000152b0f60090d28de8c6f443a2e2f03f206b0aed2c03d80cf76946cd6768a04b71482f25d4f6265d14)<br><br></font></div></div><div><font face="monospace"><br></font></div></blockquote><font face="verdana, sans-serif">Is what I&#39;m doing possible?  If so what is the correct way to specify the metadata of the idp?</font><div><font face="verdana, sans-serif">Can you specify the entityID in the Artifact URL when sending the artifact?<br></font><div><font face="verdana, sans-serif"><br></font></div><div><font face="verdana, sans-serif"><br></font></div><div>Cheers,</div><div>Matthew</div><div><div><font face="monospace"><br></font></div></div></div></div>