<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/25/16 1:28 PM, Yavor Yanakiev
wrote:<br>
</div>
<blockquote
cite="mid:CABracW+dF3CjCevshK3C_RbmmF+VMXBcX7TRSMDH-V3Xo-xzAw@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
2016-05-25 13:23:50,546 - DEBUG
[org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:126]
- Endpoint Resolver
org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:
Neither candidate endpoint location '<a moz-do-not-send="true"
href="https://securelb.imodules.com/controls/login/AssertionConsumerService.aspx?sid=-10680">https://securelb.imodules.com/controls/login/AssertionConsumerService.aspx?sid=-10680</a>'
nor response location 'null' matched '<a moz-do-not-send="true"
href="https://securelb.imodules.com/controls/login/AssertionConsumerService.aspx?sid=-10680&gid=1">https://securelb.imodules.com/controls/login/AssertionConsumerService.aspx?sid=-10680&gid=1</a>'
<br>
2016-05-25 13:23:50,546 - DEBUG
[org.opensaml.saml.common.binding.AbstractEndpointResolver:130]
- Endpoint Resolver
org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:
No candidate endpoints met criteria<br>
</div>
</blockquote>
<br>
So as Scott said, the skipEndpointValidationWhenSigned isn't working
b/c of the absense of the ProtocolBinding.<br>
<br>
So it's then failing back to trying standard metadata-based
validation. And per the above log entry, the metadata doesn't match
what's in the request. The request ACS URL has the additional query
param "gid=1", so it's not valid.<br>
<br>
So You either need to 1) fix the metadata, or 2) they need to fix
the ACS URL sent in the request. (Or 3) they need to enhance the
request to include ProtocolBinding, which probably allows the
skipEndpointValidationWhenSigned to work. They should also omit
AssertionConsumerServiceIndex while they're at it.)<br>
</body>
</html>