<div dir="ltr"><div>Hi David,</div><div><br></div><div>I have tried with URL encoding but no luck :( </div><div><br></div><div>I observed that when I am trying IDP initiated flow with testshib SP url <span style="color:rgb(26,26,166);font-family:monospace;font-size:13px"><a href="https://sp.testshib.org/shibboleth-sp">https://sp.testshib.org/shibboleth-sp</a>, </span><span style="font-family:monospace;font-size:13px"><font color="#000000">its working fine.</font></span></div><div><span style="font-family:monospace;font-size:13px"><font color="#444444">Full IDP initiated url is : </font></span><font color="#1a1aa6" face="monospace"><a href="https://idp.xxxxx.com/idp/profile/SAML2/Unsolicited/SSO?providerId=https://sp.testshib.org/shibboleth-sp">https://idp.xxxxx.com/idp/profile/SAML2/Unsolicited/SSO?providerId=https://sp.testshib.org/shibboleth-sp</a></font></div><div><font color="#000000" face="monospace">But the same thing is not working when I am using my SP url (although SP initiated authentication is working fine for my SP).</font></div><div><font color="#000000" face="monospace"><br></font></div><div><font color="#000000" face="monospace">Now I am really confused where the problem is. </font></div><div><font color="#000000" face="monospace"><br></font></div><div><font color="#000000" face="monospace">Attaching my full SP metadata xml, could you please verify it once and suggest me where is the actual issue and how to resolve the same.</font></div><div><font color="#000000" face="monospace"><br></font></div><div><font color="#000000" face="monospace">-------------------------------</font></div><div><font face="monospace"><div><font color="#674ea7"><?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="https___shibboleth-sp-xxxxx.com_shibboleth-sp" entityID="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp">https://shibboleth-sp-xxxxx.com/shibboleth-sp</a>"><ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/><ds:SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1">http://www.w3.org/2000/09/xmldsig#rsa-sha1</a>"/><ds:Reference URI="#https___shibboleth-sp-xxxxx.com_shibboleth-sp"><ds:Transforms><ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature">http://www.w3.org/2000/09/xmldsig#enveloped-signature</a>"/><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a>"/></ds:Transforms><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>"/><ds:DigestValue>OreU/14CANZdlXlhfpOdBwvjv3E=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>I0g7LWoPmja4lyu/9HlOeV71rD8djAcSPRVgnEESwMIgcLMR1cacc3HUaztSOE6cwmP+nk/vnfhxdp3mSlMnxlwiJVpODSuBZAdSLcMHKy4W0Ah9205X1ev+HqAEz/7VxPke2/dv1rV4bonvs49MA+qCe54F9XtgfoTeVPY+gDqWMerrtUj9G92p2w0F/VIjE50A==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDUjCCAjqgAwIBAgIEUOLIQTANBgkqhkiG9w0BAQUFADBrMQswCQYDVQQGEwJGSTEQMA4GA1UE</font></div><div><font color="#674ea7">CBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kxGDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEM</font></div><div><font color="#674ea7">MAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8wHhOksjQN7xoQZLj9xXefxCFQ69FPcFDeEW</font></div><div><font color="#674ea7">bHwSoBy5hLPNALaEUoa5zPDwlixwRjFQTc5XXaRpgIjy/2gsL8+Y5QRhyXnLqgO67BlLYW/GuHE=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:KeyDescriptor use="signing"><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><ds:X509Data><ds:X509Certificate>MIIDUjCCAjqgAwIBAgIEUOLIQTANBgkqhkiG9w0BAQUFADBrMQswCQYDVQQGEwJGSTEQMA4GA1UE</font></div><div><font color="#674ea7">CBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kxGDAWBgNVBAoTD1JNNSBTb2Z0d2FyZSBPeTEM</font></div><div><font color="#674ea7">MAoGA1UECwwDUiZEMQ8wDQYDVQQDEwZhcG9sbG8wHhcNMTVQ49zRvi5qWNRttiFQ69FPcFDeEW</font></div><div><font color="#674ea7">bHwSoBy5hLPNALaEUoa5zPDwlixwRjFQTc5XXaRpgIjy/2gsL8+Y5QRhyXnLqgO67BlLYW/GuHE=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:KeyDescriptor use="encryption"><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"><ds:X509Data><ds:X509Certificate>MIIDUjCCAjqgAwIBAgIEUOLIQTANBgkqhkiG9w0BAQUFADBrMQswCQYDVQQGEwJGSTEQMA4GA1UE</font></div><div><font color="#674ea7">CBMHVXVzaW1hYTERMA8GA1UEBxMISGVsc2lua2kxGDAWBgNVBAoTD1JNNSBTb2ZFQ69FPcFDeEW</font></div><div><font color="#674ea7">bHwSoBy5hLPNALaEUoa5zPDwlixwRjFQTc5XXaRpgIjy/2gsL8+Y5QRhyXnLqgO67BlLYW/GuHE=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SingleLogout">https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SingleLogout</a>"/><md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SingleLogout">https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SingleLogout</a>"/><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SSO">https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SSO</a>" index="0" isDefault="true"/><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SSO">https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SSO</a>" index="1"/></md:SPSSODescriptor></md:EntityDescriptor></font></div><div style="color:rgb(0,0,0)"><br></div><div style="color:rgb(0,0,0)">---------------------------------------</div></font></div><div><font color="#000000" face="monospace"><br></font></div><div>Please help. Many thanks.</div><div><br></div><div><br></div><div>Snahasish</div><br><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Nov 20, 2017 at 9:26 PM, David Huebner <span dir="ltr"><<a href="mailto:david.huebner@daasi.de" target="_blank">david.huebner@daasi.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<tt>Since you are masking all the relevant URLs please make sure
that the entityID in the metadata exactly matches the one you try
to initiate SSO with.</tt><tt><br>
</tt><tt><br>
</tt><tt>Oh and you probably have to URL-encode the entityID when
requesting SSO.</tt><tt><br>
</tt><tt><br>
</tt><tt>Refer to the examples in
<a class="gmail-m_-4973865335710891534moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/IDP30/<wbr>UnsolicitedSSOConfiguration</a></tt><div><div class="gmail-h5"><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt>
<div class="gmail-m_-4973865335710891534moz-cite-prefix"><tt>On 20.11.2017 15:52, Santu Ghosh
wrote:</tt><tt><br>
</tt></div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail-m_-4973865335710891534gmail_signature"><tt>Hi David,</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt>Thanks for your response.</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><span style="font-size:10.4px">- you did not register the SP in your IdP (i.e.
load metadata of the SP)</span></tt><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><span style="font-size:10.4px">
This is working fine if we test SP initiated flow</span></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><span style="font-size:10.4px"><br>
</span></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt>-the entityID in your URL
does not match the entityID in the metadata file</tt><tt><br>
</tt><tt>- you did add the metadata but forgot to reload the
MetadataResolverService (or just restart Tomcat/Jetty)</tt><span style="font-size:10.4px"><br>
</span></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt> We have done above
mentioned two steps every time when we made any changed
(if necessary) in xml.</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt>Our IDP metadata looks like :</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><EntityDescriptor
xmlns="urn:oasis:names:tc:<wbr>SAML:2.0:metadata" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#</a>"
xmlns:shibmd="urn:mace:<wbr>shibboleth:metadata:1.0"
xmlns:mdui="urn:oasis:names:<wbr>tc:SAML:metadata:ui"
entityID="<a href="https://idp.xxxxxxxx.com/idp/shibboleth" target="_blank">https://idp.<wbr>xxxxxxxx.com/idp/shibboleth</a>"></font></tt><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt>And SP metadata looks like :</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><?xml
version="1.0"
encoding="UTF-8"?><md:<wbr>EntityDescriptor
xmlns:md="urn:oasis:names:tc:<wbr>SAML:2.0:metadata"
ID="https___shibboleth-sp.<wbr>xxxxxxx.com_shibboleth-sp"
entityID="<a href="https://shibboleth-sp.xxxxxxxx.com/shibboleth-sp" target="_blank">https://shibboleth-<wbr>sp.xxxxxxxx.com/shibboleth-sp</a>"<wbr>><ds:Signature
xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#</a>"><ds:<wbr>SignedInfo><ds:<wbr>CanonicalizationMethod
Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/<wbr>2001/10/xml-exc-c14n#</a>"/><ds:<wbr>SignatureMethod
Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#rsa-sha1</a>"/><<wbr>ds:Reference
URI="#https___shibboleth-sp.<wbr>xxxxxxx.com_shibboleth-sp"><<wbr>ds:Transforms><ds:Transform
Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#enveloped-<wbr>signature</a>"/><ds:Transform
Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/<wbr>2001/10/xml-exc-c14n#</a>"/></ds:<wbr>Transforms><ds:DigestMethod
Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#sha1</a>"/><ds:<wbr>DigestValue>OreU/<wbr>14CANZdlXlhfpOdBwvjv3E=</ds:<wbr>DigestValue></ds:Reference></<wbr>ds:SignedInfo><ds:<wbr>SignatureValue><wbr>I0g7LWoPmja4lyu/9H</font></tt><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><br>
</font></tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><br>
</font></tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt>Can you please take a look.</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="gmail-m_-4973865335710891534gmail_signature"><tt>Snahasish</tt></div>
</div>
</div>
<tt><br>
</tt>
<fieldset class="gmail-m_-4973865335710891534mimeAttachmentHeader"></fieldset>
<tt><br>
</tt>
</blockquote>
<tt><br>
</tt>
</div></div></div>
<br>--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Snahasish Ghosh<br>System Engineer.<br>Mobile No- (0)9733960336<br></div>
</div></div>