<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 11 June 2015 at 15:45, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000"><span class="">
    <br>
    <br>
    <div>On 6/11/15 12:55 PM, Alain O'Dea wrote:<br>
    </div>
    </span><blockquote type="cite">
      <div dir="ltr">
        <div class="gmail_extra">
          <div class="gmail_quote"><span class="">I changed <a href="https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19" target="_blank">https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19</a>
            to:
            <div>appSettings.setIssuer("<a href="http://localhost:8080/consume.jsp" target="_blank">http://localhost:8080/consume.jsp</a>");<br>
            </div>
            <div><br>
            </div>
            <div>And I changed the relyingPartyIds in the
              relying-party.xml override that disables assertion
              encryption:</div>
            <div><br>
            </div>
            </span><div><span class="">
              <div>        <bean parent="RelyingPartyByName"
                c:relyingPartyIds="<a href="http://localhost:8080/consume.jsp" target="_blank">http://localhost:8080/consume.jsp</a>"></div>
              <br>
              </span><div>        </bean></div>
            </div><span class="">
            <div><br>
            </div>
            <div>And I changed the entityId in my SP metadata to <a href="http://localhost:8080/consume.jsp" target="_blank">http://localhost:8080/consume.jsp</a>.<br>
            </div>
          </span></div>
        </div>
      </div>
    </blockquote>
    <br>
    <br>
    Just so you know: SAML entityIDs are not (typically) actual
    endpoints in your app.   They usually don't include port numbers or
    reference specific actual endpoints/pages. They typically are not
    resovleable URL's, and are sometimes not even URL's at all - they
    can be URN's for example, or technically any subtype of URI. They
    are just URIs used as identifiers of the SAML actor, period.<br>
    <br>
    What you have there may work for testing as long as you set
    everything consistently. But a more realistic choice for the SP
    entityID would be something like <a href="http://localhost/sp/onelogin" target="_blank">http://localhost/sp/onelogin</a>, or
    even better, replace localhost with an FQDN.<br>
    <br>
    So what they're doing there by default with:<br>
    <br>
    
    <tt><span>appSettings<span>.</span>setIssuer(<span><span>"</span><a href="http://localhost:8080/index.jsp" target="_blank">http://localhost:8080/index.jsp</a><span>"</span></span>);</span></tt><br>
    <br>
    is quite misleading.  On the other hand, the
    AssertionConsumerServiceUrl setting is correct:<br>
    <br>
    <tt>appSettings.setAssertionConsumerServiceUrl(<a href="http://localhost:8080/consume.jsp" target="_blank">"http://localhost:8080/consume.jsp"</a>);</tt><br>
    <br>
    That should be the actual URL endpoint in the SP which will receive
    the response back from the IdP.<br></div></blockquote><div><br></div><div>That is extremely helpful Brent.  Thank you.  It seemed odd to have a specific page referenced.  Regrettably, saml-java explicitly couples the issuer to the consumerServiceURL here:</div><div><a href="https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/src/main/java/com/onelogin/saml/Response.java#L163-165">https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/src/main/java/com/onelogin/saml/Response.java#L163-165</a></div><div><br></div><div>I don't have a choice about issuer being a URL unless I reimplement using OpenSAML.  That is becoming a more compelling path now as more gaps in saml-java reveal themselves.<br></div></div></div></div>