<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<meta name="Generator" content="Microsoft Exchange Server" class="">
<!-- converted from text --><style class=""><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
<div class="">
<div class="">Hi Peter,</div>
<div class=""><br class="">
</div>
<div class="">I realized I forgot to include some info. I am running Shibboleth SP v2.6 on (3) RHEL 7 boxes which sit behind a load balancer. I was able to get things up and running using the shibboleth2.xml file with a few customization for our environment.
Since I am working in a clustered environment I deviated from my working default in an attempt to implement/configure an ODBC Storage Service. The documentation for NativeSPODBCStorageService ( <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPODBCStorageService" class="">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPODBCStorageService</a>) required
me to set a few things up differently than I would have normally, as such I looked at the example-shibboleth2.xml file to make sure I placed the OutOfProcess, StorageService, SessionInitiator, and LogoutInitiator in the proper places in the shibboleth2.xml
file (I was initially getting errors due to order). Since my SPs can talk to my IDP with a default config there has to be something I missed following the documentation. In someone else’s post it was suggested to make sure the metadata matched so I updated
my IDP with new metadata from my SPs just incase something changed but I’m still receiving the error. My logs are telling me</div>
<div class=""><br class="">
</div>
<div class="">native.log</div>
<div class="">2017-06-15 21:31:38 ERROR Shibboleth.Apache [4181] shib_check_user: Unable to locate a SAML 2.0 ACS endpoint to use for response.</div>
<div class=""><br class="">
</div>
<div class="">-Chris</div>
<div class=""><br class="">
<hr tabindex="-1" style="display:inline-block; width:98%" class="">
<div id="x_divRplyFwdMsg" dir="ltr" class=""><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt" class=""><b class="">From:</b> users <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a>> on behalf of
Peter Schober <<a href="mailto:peter.schober@univie.ac.at" class="">peter.schober@univie.ac.at</a>><br class="">
<b class="">Sent:</b> Friday, June 16, 2017 6:56 AM<br class="">
<b class="">To:</b> <a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a><br class="">
<b class="">Subject:</b> Re: Unable to locate a SAML 2.0 ACS endpoint to use for response</font>
<div class=""> </div>
</div>
</div>
<font size="2" class=""><span style="font-size:10pt;" class="">
<div class="PlainText">* Mr. Christopher Bland <<a href="mailto:chris@fdu.edu" class="">chris@fdu.edu</a>> [2017-06-16 03:50]:<br class="">
> I am troubleshooting a cluster of SPs behind a load balancer and<br class="">
> keep getting "Unable to locate a SAML 2.0 ACS endpoint to use for<br class="">
> response”<br class="">
<br class="">
All prior warnings and the context for that error message might be<br class="">
relevant.<br class="">
<br class="">
> <MetadataProvider type="Chaining"><br class="">
> <MetadataProvider type="XML" url="<a href="https://identity-provider/idp/profile/Metadata/SAML" class="">https://identity-provider/idp/profile/Metadata/SAML</a>" backingFilePath="idp-metadata.xml"/><br class="">
> <MetadataProvider type="XML" url="<a href="https://dev_identity-provider/idp/profile/Metadata/SAML" class="">https://dev_identity-provider/idp/profile/Metadata/SAML</a>" backingFilePath="idpdev-metadata.xml"/><br class="">
> </MetadataProvider><br class="">
<br class="">
Note that the wrapping "Chaining" provider is unnecessary, and more<br class="">
gravely, that the above is rather insecure (unless you're willing to<br class="">
bet that TLS alone will be good enough, no matter what kind of<br class="">
metadata get's served there, with how many entityIDs, etc.)<br class="">
<br class="">
If the servers/entities you're downloading metadata from are not your<br class="">
own, you'd better add an entity whitelist filter to those, too,<br class="">
otherwise these IDPs (or servers, or anyone in between managing to<br class="">
MITM this connection) could impersonate anything and anyone to your<br class="">
SP.<br class="">
If those entities are your own I'd question the need for such<br class="">
dynamicity and either supply those as local, verified, static files,<br class="">
or maybe add some config management tooling to distribute those.<br class="">
Finally, you (or the producer of this metadata) could also sign the<br class="">
metadata (though you may still want to add a filter, to only let<br class="">
expected entityIDs pass).<br class="">
<br class="">
> I believe I made the correct changes based on documentation and<br class="">
> example-shibboleth2.xml file but it doesn’t work.<br class="">
<br class="">
If you've literally been changing the file example-shibboleth2.xml<br class="">
then "it doesn't work" is the expected result of such action:<br class="">
example-shibboleth2.xml is not used by the software by default (hence<br class="">
the name), but shibboleth2.xml is.<br class="">
<br class="">
-peter<br class="">
-- <br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</span></font></div>
</body>
</html>