<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Sorry if this echos but I sent it yesterday and saw no indication that it had been processed from the mailing list side…<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m installing the SP on an IIS VM to authenticate against a webapp (not one I maintain). I’ve done it fine internal-only on a test clone, but the live one is published via a reverse proxy and is secure-only so I need to do the live one
slightly differently.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I got the Metadata after installing the SP on the live server, and amended all the bind URLs to be https:// before adding the metadata to my IdP (3.1.1 fwiw – I’ve pencilled in upgrading to 3.3 over summer).<o:p></o:p></p>
<p class="MsoNormal">And now get this error:<o:p></o:p></p>
<p class="MsoNormal">‘Unable to Respond<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The login service was unable to identify a compatible way to respond to the requested resource. This is generally to due to a misconfiguration on the part of the resource and should be reported.’<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">DEBUG log lines from the failed attempt (IdP side, no warnings in the SP native.log):<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,658 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:505] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,659 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:220] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Returning 6 candidate endpoints of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,659 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:126] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint location did not match
<a href="http://heritage.srv.hull-college.ac.uk/Shibboleth.sso/SAML2/POST">http://heritage.srv.hull-college.ac.uk/Shibboleth.sso/SAML2/POST</a><o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,659 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:117] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding did not match urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,660 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:117] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding did not match urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,660 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:86] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding urn:oasis:names:tc:SAML:2.0:bindings:PAOS
not permitted by input criteria<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,660 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:86] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding urn:oasis:names:tc:SAML:1.0:profiles:browser-post
not permitted by input criteria<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,661 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:86] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding urn:oasis:names:tc:SAML:1.0:profiles:artifact-01
not permitted by input criteria<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,661 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:130] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: No candidate endpoints met criteria<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,661 - WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:402] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint<o:p></o:p></p>
<p class="MsoNormal">2017-05-30 11:36:37,664 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:154] - No SAMLBindingContext or binding URI available, error must be handled locally<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The issue, I think, is that it is still looking for an http:// binding URL, even though the metadata for this SP has no traces of http:// in the bindings – I’ve attached the metadata (without the certificate bit).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve made sure the external DNS name in the SP config is set to be the correct domain that it maps to externally, that it maps to the site ID from IIS and the entityID for the SP matches it in the metadata.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">One thing I should also mention in case it matters - in shibboleth2.xml I put the entity ID as the URL of our IdP (<a href="https://shibb.srv.hull-college.ac.uk/idp/shibboleth">https://shibb.srv.hull-college.ac.uk/idp/shibboleth</a>) –
which is different to its entityID (<a href="http://shibb.hull-college.ac.uk/idp/shibboleth">http://shibb.hull-college.ac.uk/idp/shibboleth</a>). We were advised to keep the old entityID by the UK Federation when migrating to the v3 server. But I can’t see
anything in the documentation for the <SSO> tag of <ApplicationDefaults> which explains how to handle this scenario. We only want the SP to authenticate against our IdP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What am I missing?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Dave<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">_________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">Dave Perry<br>
eLearning Technologist, Hull College Group <b>(Monday – Thursday)</b><br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">* Need a fast reply? Try
<a href="mailto:elearning@hull-college.ac.uk">elearning@hull-college.ac.uk</a> *<o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<font color="#999999" size="2">
<span style="font-family: Arial;"><a href="http://www.hull-college.ac.uk/publications">Click here to view the College's range of publications celebrating staff and student successes</a></span> </font></div><div><font color="#999999" size="2"><br />
<font face="Arial">This message is sent in confidence for the addressee </font>
<span style="font-family: Arial;">only. It may contain confidential or sensitive </span>
<span style="font-family: Arial;">information. The contents are not to be disclosed </span>
<span style="font-family: Arial;">to anyone other than the addressee. Unauthorised </span>
<span style="font-family: Arial;">recipients are requested to preserve this </span>
<span style="font-family: Arial;">confidentiality and to advise us of any errors in </span>
<span style="font-family: Arial;">transmission. Any views expressed in this message </span>
<span style="font-family: Arial;">are solely the views of the individual and do not </span>
<span style="font-family: Arial;">represent the views of the College. Nothing in this </span>
<span style="font-family: Arial;">message should be construed as creating a contract.</span>
</font>
</div>
<div>
<font color="#999999" face="Arial" size="2">
<br />
</font>
</div>
<div>
<font color="#999999" face="Arial" size="2">Hull College Group owns the email infrastructure, including the contents.</font>
</div>
<div>
<font color="#999999" face="Arial" size="2">
<br />
</font>
</div>
<div>
<font color="#00cc33" face="Arial" size="2">Hull College Group is committed to sustainability, please reflect before printing
this email.</font>
</div>
<div>
<hr />
</div>
</body>
</html>