<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Issue number A is that the ndk dingbat responsible for running TestShib still hasn't upgraded it to v3. I'll coordinate with my fellow dingbats.<br>
<br>
I suspect your metadata just expired. I can dig in and tell you exactly what's broken if you'll share your entityID in a message.<br>
<br>
<br>
<br>
On 01/19/2017 02:52 AM, Mark Watson wrote:<br>
</div>
<blockquote cite="mid:CAH5M_km8WgdWSi020MEoL5purJ6wKaTXJPLMkS8iRZt0jCwGaw@mail.gmail.com" type="cite">
<div dir="ltr">I'm having an issue getting my HTTP-Redirect based SP correctly logging in to TestShib. I'd previously had success but I'm scratching my head to figure out what's changed. I'll include the raw AuthnRequest and Metadata file at the end.
<div><br>
</div>
<div>The error I'm receiving is: </div>
<h5 id="gmail-IdPTroubleshootingCommonErrors-edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:Noreturnendpointavailableforrelyingparty..." style="margin:20px 0px
0px;padding:0px;color:rgb(61,61,61);font-size:14px;line-height:1.66667;font-family:arial,sans-serif">
edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler: No return endpoint available for relying party ...</h5>
<div><br>
</div>
<div>=====================================================<br>
</div>
<div><br>
</div>
<div>Going through the three issues from <a moz-do-not-send="true" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTroubleshootingCommonErrors"></a><a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTroubleshootingCommonErrors">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPTroubleshootingCommonErrors</a></div>
<div><br>
</div>
<div>
<ol>
<li><br>
<ul>
<li>Either there is no metadata (either filtered out or expired)<br>
<br>
I've uploaded fresh metadata as of today so it shouldn't be filtered out or expired. I received the "Your metadata was uploaded successfully..." message from TestShib.<br>
<br>
</li><li>The metadata version does not match the service provider SAML request<br>
<br>
The metadata file defines:<br>
<md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
<br>
The SP AuthnRequest defines:<br>
<saml2p:AuthnRequest AssertionConsumerServiceURL="<a moz-do-not-send="true" href="http://myserver/sso/sp"></a><a class="moz-txt-link-freetext" href="http://myserver/sso/sp">http://myserver/sso/sp</a>" Destination="<a moz-do-not-send="true" href="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO">https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO</a>"
<br>
ID="_0ec2d4169119606f16ca1f2ad312c115" <br>
IssueInstant="2017-01-18T23:24:42.029Z"<br>
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" <br>
Version="2.0" <br>
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><br>
</li><li>The service provider is sending an assertion consumer index that the identity provider can't locate.<br>
<br>
The SP isn't sending an assertion consumer index.<br>
<br>
</li></ul>
</li><li>The IdP does not support the binding for the response endpoint requested by the service providers. For example if the SP requires the IdP send a response back by means of an artifact but the IdP does not support artifacts:<br>
<br>
>From the TestShib metadata file:<br>
<br>
<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a moz-do-not-send="true" href="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO">https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO</a>"/><br>
<br>
This matches the destination URL seen in the above AuthnRequest.<br>
<br>
</li><li>A generalized case of the previous issue. The Service Provider does not specify a particular response endpoint, but the IdP does not support any of bindings listed in the service providers metadata.<br>
<br>
>From the SP metadata:<br>
<br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a moz-do-not-send="true" href="http://myserver/sso/sp">http://myserver/sso/sp</a>" index="0" isDefault="true"/><br>
</li></ol>
<div><br>
</div>
</div>
<div>=====================================================<br>
</div>
<div><br>
</div>
<div>If anyone can lend a hand I'd really appreciate it. For a raw copy of the AuthnRequest and SP Metadata minus identifying details:</div>
<div><br>
</div>
<div>SP Metadata:</div>
<div><br>
</div>
<div>
<div><md:EntityDescriptor entityID="<a moz-do-not-send="true" href="http://myserver/sso"></a><a class="moz-txt-link-freetext" href="http://myserver/sso">http://myserver/sso</a>" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"></div>
<div> <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"></div>
<div> <md:KeyDescriptor use="encryption"></div>
<div> <ds:KeyInfo xmlns:ds="<a moz-do-not-send="true" href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div>
<div> <ds:X509Data></div>
<div> <ds:X509Certificate> ** Key Removed ** </ds:X509Certificate></div>
<div> </ds:X509Data></div>
<div> </ds:KeyInfo></div>
<div> </md:KeyDescriptor></div>
<div> <md:KeyDescriptor use="signing"></div>
<div> <ds:KeyInfo xmlns:ds="<a moz-do-not-send="true" href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div>
<div> <ds:X509Data></div>
<div> <ds:X509Certificate> ** Key Removed ** </ds:X509Certificate></div>
<div> </ds:X509Data></div>
<div> </ds:KeyInfo></div>
<div> </md:KeyDescriptor></div>
<div> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat></div>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a moz-do-not-send="true" href="http://myserver/sso/sp">http://myserver/sso/sp</a>" index="0" isDefault="true"/></div>
<div> </md:SPSSODescriptor></div>
<div></md:EntityDescriptor></div>
</div>
<div><br>
</div>
<div>AuthnRequest:</div>
<div><br>
</div>
<div>
<div><?xml version="1.0" encoding="UTF-8"?></div>
<div><saml2p:AuthnRequest </div>
<div> AssertionConsumerServiceURL="<a moz-do-not-send="true" href="http://myserver/sso/sp"></a><a class="moz-txt-link-freetext" href="http://myserver/sso/sp">http://myserver/sso/sp</a>" </div>
<div> Destination="<a moz-do-not-send="true" href="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO">https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO</a>" </div>
<div> ID="_0ec2d4169119606f16ca1f2ad312c115" </div>
<div> IssueInstant="2017-01-18T23:24:42.029Z" </div>
<div> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" </div>
<div> Version="2.0" </div>
<div> xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"></div>
<div> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a moz-do-not-send="true" href="http://myserver/sso"></a><a class="moz-txt-link-freetext" href="http://myserver/sso">http://myserver/sso</a></saml2:Issuer></div>
<div> <saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/></div>
<div> <saml2p:RequestedAuthnContext Comparison="minimum"></div>
<div> <saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef></div>
<div> </saml2p:RequestedAuthnContext></div>
<div></saml2p:AuthnRequest></div>
</div>
<div><br>
</div>
<div>Thanks in advance!</div>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>