<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New",serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New",serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m working with on moving an SP that uses SAML2.ArtifactResolution configuration from IDP2 to our new IDP 3. The integration works fine on IDP2 but when moving over to IDP 3, we’re seeing errors in the SAML which is causing the AuthN to
fail.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below find my relying party.xml configuration from the new IDP:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><property name="profileConfigurations"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="SAML1.AttributeQuery" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="SAML1.ArtifactResolution" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="SAML2.ECP" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="SAML2.Logout" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="SAML2.AttributeQuery" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="SAML2.ArtifactResolution" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="Liberty.SSOS" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="CAS.LoginConfiguration" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="CAS.ProxyConfiguration" /><o:p></o:p></p>
<p class="MsoNormal"> <ref bean="CAS.ValidateConfiguration" /><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://temr.regenstrief.org?instid=9003'}}"><o:p></o:p></p>
<p class="MsoNormal"> <property name="profileConfigurations"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.ArtifactResolution" p:encryptAssertions="false" p:encryptNameIDs="false" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="SAML2.SSO" p:encryptAssertions="false" /><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What the vendor has indicated is that the appropriate query string is missing when calling the SAML artifact from the SP. The query string should exist as indicated in the entity id (<i><a href="https://temr.regenstrief.org?instid=9003)The">https://temr.regenstrief.org?<span style="background:yellow;mso-highlight:yellow">instid=9003</span><span style="font-style:normal">)The</span></a></i>
response returns an internal server error as indicated below. The first response below is from my actual SAML trace. The second is the exact same response, which includes the missing query string. The second response is what
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">---------- 1 ----------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">GET
<a href="https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul?SAMLart=AAQAAtMyr%2FtHTOLrFFy7YH71vdkMC3e8TM21pehJu4Km%2FDvtlNTNpKRZBkU%3D">
https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul?SAMLart=AAQAAtMyr%2FtHTOLrFFy7YH71vdkMC3e8TM21pehJu4Km%2FDvtlNTNpKRZBkU%3D</a> HTTP/1.1<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Host</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: temr.regenstrief.org<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">User-Agent</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Accept</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Accept-Language</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: en-US,en;q=0.5<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Accept-Encoding</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: gzip, deflate, br<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Referer</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">:
<a href="https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul">
https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul</a><o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Cookie</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: institutionIdParam=9003; institutionIdParam=9003; JSESSIONID=EABAAF6FF3B4A1BBCBF66CBD2B20978C.webapp171<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New",serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">HTTP/?.? 500 Internal Server Error<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Date</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: Wed, 26 Apr 2017 15:18:53 GMT<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Expires</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: -1<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">X-Frame-Options</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: SAMEORIGIN<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Pragma</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: no-cache<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Cache-Control</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: private, no-cache, no-store<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Content-Encoding</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: gzip<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Content-Type</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: text/html;charset=UTF-8<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Content-Language</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: en-US<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Content-Length</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: 4347<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Courier New",serif">Connection</span></b><span style="font-size:10.0pt;font-family:"Courier New",serif">: close<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">---------- 2 ----------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<pre><b>GET <a href="https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul?instid=9003&SAMLart=AAQAAtMyr%2FtHTOLrFFy7YH71vdkMC3e8TM21pehJu4Km%2FDvtlNTNpKRZBkU%3D">https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul?<span style="background:yellow;mso-highlight:yellow">instid=9003</span>&SAMLart=AAQAAtMyr%2FtHTOLrFFy7YH71vdkMC3e8TM21pehJu4Km%2FDvtlNTNpKRZBkU%3D</a> HTTP/1.1<o:p></o:p></b></pre>
<pre><b>Host</b>: temr.regenstrief.org<o:p></o:p></pre>
<pre><b>User-Agent</b>: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0<o:p></o:p></pre>
<pre><b>Accept</b>: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<o:p></o:p></pre>
<pre><b>Accept-Language</b>: en-US,en;q=0.5<o:p></o:p></pre>
<pre><b>Accept-Encoding</b>: gzip, deflate, br<o:p></o:p></pre>
<pre><b>Referer</b>: <a href="https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul">https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul</a><o:p></o:p></pre>
<pre><b>Cookie</b>: <span style="background:yellow;mso-highlight:yellow">institutionIdParam=9003</span>; institutionIdParam=9003; JSESSIONID=EABAAF6FF3B4A1BBCBF66CBD2B20978C.webapp171<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">How can I get the IDP to include that detail in the URL? Is that even possible. Is my setup misconfigured? Could this be an issue with the vendor metadata? Also, looking at the response, it looks like the value I need is being stored in
a cookie (institutionIdParam=9003). Could this be where I have misconfigured this?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any assistance would be appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Drew Zebrowski<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<table width="650px" cellpadding="15" style="border: 1px solid #8f9193" bgcolor="#e5ecf2">
<tbody>
<tr>
<td>
<p style="font-size:8pt; line-height:10pt; color:#475054; font-family: 'Cambria','times roman',serif;">
The information contained in this transmission contains privileged and confidential information. It is intended only for the use of the person named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution
or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.
<br>
<br>
<strong><u>CAUTION</u></strong>: Intended recipients should NOT use email communication for emergent or urgent health care matters.<br>
</p>
</td>
</tr>
</tbody>
</table>
</body>
</html>