<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 6/11/15 12:55 PM, Alain O'Dea wrote:<br>
</div>
<blockquote
cite="mid:CAM6cUzDVVFut15Auo6-cVAoiD1M7+f5zmn3QWQwGSAVrdvoXgg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">I changed <a moz-do-not-send="true"
href="https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19">https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19</a>
to:
<div>appSettings.setIssuer("<a moz-do-not-send="true"
href="http://localhost:8080/consume.jsp">http://localhost:8080/consume.jsp</a>");<br>
</div>
<div><br>
</div>
<div>And I changed the relyingPartyIds in the
relying-party.xml override that disables assertion
encryption:</div>
<div><br>
</div>
<div>
<div> <bean parent="RelyingPartyByName"
c:relyingPartyIds="<a moz-do-not-send="true"
href="http://localhost:8080/consume.jsp">http://localhost:8080/consume.jsp</a>"></div>
<br>
<div> </bean></div>
</div>
<div><br>
</div>
<div>And I changed the entityId in my SP metadata to <a
moz-do-not-send="true"
href="http://localhost:8080/consume.jsp">http://localhost:8080/consume.jsp</a>.<br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
Just so you know: SAML entityIDs are not (typically) actual
endpoints in your app. They usually don't include port numbers or
reference specific actual endpoints/pages. They typically are not
resovleable URL's, and are sometimes not even URL's at all - they
can be URN's for example, or technically any subtype of URI. They
are just URIs used as identifiers of the SAML actor, period.<br>
<br>
What you have there may work for testing as long as you set
everything consistently. But a more realistic choice for the SP
entityID would be something like <a class="moz-txt-link-freetext" href="http://localhost/sp/onelogin">http://localhost/sp/onelogin</a>, or
even better, replace localhost with an FQDN.<br>
<br>
So what they're doing there by default with:<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<tt><span class="pl-s1">appSettings<span class="pl-k">.</span>setIssuer(<span
class="pl-s"><span class="pl-pds">"</span><a class="moz-txt-link-freetext" href="http://localhost:8080/index.jsp">http://localhost:8080/index.jsp</a><span
class="pl-pds">"</span></span>);</span></tt><br>
<br>
is quite misleading. On the other hand, the
AssertionConsumerServiceUrl setting is correct:<br>
<br>
<tt>appSettings.setAssertionConsumerServiceUrl(<a class="moz-txt-link-rfc2396E" href="http://localhost:8080/consume.jsp">"http://localhost:8080/consume.jsp"</a>);</tt><br>
<br>
That should be the actual URL endpoint in the SP which will receive
the response back from the IdP.<br>
<br>
<br>
</body>
</html>