<div dir="ltr"><p class="MsoNormal">We are working on configuring SSO for Concur. We are using.
We followed the instructions, but am not sure why the SSO is failing. The url
we are using is
<a href="https://our-idp-host.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://implementation.concursolutions.com">https://our-idp-host.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://implementation.concursolutions.com</a>.
The url brings up our login page. The login portion against our ldap is working
in that if I enter a bogus username and password, I am prompted to enter a
correct password. When I use valid credentials, I am forwarded to:
<a href="https://implementation.concursolutions.com/?result=InvalidXML">https://implementation.concursolutions.com/?result=InvalidXML</a><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">I included my applicable configuration with you all below
including: attribute-resolver.xml, relying-party.xml, metadata-providers.xml,
saml-nameid.xml, and saml-nameid.properties. Any help would be greatly
appreciated.<span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">ATTRIBUTE-RESOLVER.XML<span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">    <resolver:AttributeDefinition
xsi:type="ad:Simple" id="ConcurID"
sourceAttributeID="mail"><span></span></p>

<p class="MsoNormal">       
<resolver:Dependency ref="myLDAP" /><span></span></p>

<p class="MsoNormal">       
<resolver:AttributeEncoder<span></span></p>

<p class="MsoNormal">            
xsi:type="enc:SAML2StringNameID"<span></span></p>

<p class="MsoNormal">            
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"<span></span></p>

<p class="MsoNormal">        /><span></span></p>

<p class="MsoNormal">   
</resolver:AttributeDefinition><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">ATTRIBUTE-FILTER.XML<span></span></p>

<p class="MsoNormal">         
<AttributeFilterPolicy id="releaseToConcur"><span></span></p>

<p class="MsoNormal">            
<PolicyRequirementRule xsi:type="Requester"
value="https//<a href="http://implementation.concursolutions.com/SAMLRedirector/ClientSAMLLogin.aspx">implementation.concursolutions.com/SAMLRedirector/ClientSAMLLogin.aspx</a>"
/><span></span></p>

<p class="MsoNormal">            
<AttributeRule attributeID="ConcurID"><span></span></p>

<p class="MsoNormal">                  
<PermitValueRule xsi:type="ANY" /><span></span></p>

<p class="MsoNormal">            
</AttributeRule><span></span></p>

<p class="MsoNormal">         
</AttributeFilterPolicy><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">RELYING-PARTY.XML<span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">        <bean parent="RelyingPartyByName"
c:relyingPartyIds="<a href="https://implementation.concursolutions.com">https://implementation.concursolutions.com</a>"><span></span></p>

<p class="MsoNormal">           
<property name="profileConfigurations"><span></span></p>

<p class="MsoNormal">               
<list><span></span></p>

<p class="MsoNormal">                   
<bean parent="SAML2.SSO"
p:encryptAssertions="false" p:encryptionOptional="true"
p:signAssertions="true" /><span></span></p>

<p class="MsoNormal">               
</list><span></span></p>

<p class="MsoNormal">           
</property><span></span></p>

<p class="MsoNormal">        </bean><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">METADATA-PROVIDERS.XML<span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">  <MetadataProvider
id="ConcurAVC" xsi:type="FilesystemMetadataProvider"<span></span></p>

<p class="MsoNormal">       
metadataFile="%{idp.home}/metadata/concur-test-metadata.xml"><span></span></p>

<p class="MsoNormal"> 
</MetadataProvider><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">SAML-NAMEID.XML<span></span></p>

<p class="MsoNormal">    <!-- SAML 2
NameID Generation --><span></span></p>

<p class="MsoNormal">    <util:list
id="shibboleth.SAML2NameIDGenerators"><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">        <ref
bean="shibboleth.SAML2TransientGenerator" /><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">        <!--
Uncommenting this bean requires configuration in saml-nameid.properties. --><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><!--        <ref
bean="shibboleth.SAML2PersistentGenerator" />--><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">        <bean
parent="shibboleth.SAML2AttributeSourcedGenerator"<span></span></p>

<p class="MsoNormal">           <!--
p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"--><span></span></p>

<p class="MsoNormal">          
p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"<span></span></p>

<p class="MsoNormal">           
p:attributeSourceIds="#{ {'mail'} }" /><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">    </util:list><span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal">SAML-NAMEID.PROPERTIES<span></span></p>

<p class="MsoNormal"># Comment out to disable legacy NameID generation via
Attribute Resolver<span></span></p>

<p class="MsoNormal">idp.nameid.saml2.legacyGenerator =
shibboleth.LegacySAML2NameIDGenerator<span></span></p>

<p class="MsoNormal">#idp.nameid.saml1.legacyGenerator =
shibboleth.LegacySAML1NameIdentifierGenerator<span></span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p>

<p class="MsoNormal"><span> </span></p></div>