<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:807212698;
mso-list-type:hybrid;
mso-list-template-ids:-1599696376 201916431 201916441 201916443 201916431 201916441 201916443 201916431 201916441 201916443;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style></head><body lang="EN-AU" link="blue" vlink="purple"><div class="WordSection1"><p class="MsoNormal">Hi,</p><p class="MsoNormal"> </p><p class="MsoNormal">We have set up a Shibboleth SP with Apache 2.4 and Tomcat 8 on a Windows Server and have successful integrated the SP with an external IDP on a test server.</p><p class="MsoNormal"> </p><p class="MsoNormal">However after both we and our client deployed the configurations to a preproduction server testing showed problems accessing the program. </p><p class="MsoNormal"> </p><p class="MsoNormal">When users access the URL for the first time on a browser they hit the following error message:</p><p class="MsoNormal"> </p><p class="MsoNormal"> <i>Opensaml::FatalProfileException at (<a href="https://.../Shibboleth.soo/SAML2/Post-SimpleSign">https://.../Shibboleth.soo/SAML2/Post-SimpleSign</a>)</i></p><p class="MsoNormal"><i> </i></p><p class="MsoNormal"><i> Unable to locate satisfiable bearer SubjectConfirmation in assertion</i></p><p class="MsoNormal"> </p><p class="MsoNormal">If they attempted to access the same URL again, they were able to login without any issues.</p><p class="MsoNormal"> </p><p class="MsoNormal">Reviewing the SIGNATURE DEBUG log files we identified that the user was unable to login on first attempt because the SAML token had the following “Recipient” attribute in the SubjectConfirmationData.</p><p class="MsoNormal"> </p><p class="MsoListParagraph"><i><span style="background:#f8f8f8"><Recipient=<span style="color:#dd1144">"</span></span><span style="color:#1f497d"><a href="https://.../Shibboleth.sso/SAML2/POST">https://.../Shibboleth.sso/SAML2/POST</a>”> </span></i></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="background:#f8f8f8">On the second attempt, the user was able to login and the SAML token had the following “Recipient” attribute.</span></p><p class="MsoNormal"><span style="background:#f8f8f8"> </span></p><p class="MsoNormal" style="text-indent:36.0pt"><i><span style="background:#f8f8f8"><Recipient=<span style="color:#dd1144">"<a href="https://.../Shibboleth.sso/SAML2/POST-SimpleSign">https://.../Shibboleth.sso/SAML2/POST-SimpleSign</a>"></span></span></i></p><p class="MsoNormal"> </p><p class="MsoNormal">We suspect that the IDP is not configured correctly to send the right Recipient data – it should send the ‘Post-SimpleSign’ URL for the “Recipient”. </p><p class="MsoNormal"> </p><p class="MsoNormal">However, just to be sure, we wanted to check if the incorrect recipient data could be caused by anything on the SP side? </p><p class="MsoNormal"> </p><p class="MsoNormal">Is there anything that we can do as the SP to address this?</p><p class="MsoNormal"> </p><p class="MsoNormal">Many thanks.</p><p class="MsoNormal"> </p><p class="MsoNormal">Alvin</p></div></body></html>