<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
@font-face
{font-family:"Gill Sans W01 Medium";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi All,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I need a bit of help here. We have a working SAML2 Service Provider working hundreds of IDP, and everything works fine for the Regular SAML authentication. We have started working with a customer using AttributeQuery, and it has been rather
tricky to get this to work. We have managed it in a test environment, and now moving this to a production environment where everything appears to be setup in a similar way (but obviously isn’t) we are facing this error when submitting an atttributeQuery request:
(This is a response from the IDP after we sent the attributeQuery Request to the appropriate Binding end-point https://idp.domain:9443/idp/attrsvc.ssaml2)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">HTTP 500 error: (…) <span style="font-size:8.5pt;font-family:"Lucida Console";color:red">
Incoming binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) :::</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none">
<tbody>
<tr>
<td width="623" valign="top" style="width:467.5pt;border:solid windowtext 1.0pt;padding:0cm 5.4pt 0cm 5.4pt">
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">HTTP/1.1 500 Server Error<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Date: Wed, 22 Nov 2017 11:02:31 GMT<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Content-Security-Policy: referrer origin<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Cache-Control: no-cache, no-store<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Pragma: no-cache<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Expires: Thu, 01 Jan 1970 00:00:00 GMT<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Content-Type: text/xml;charset=utf-8<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Set-Cookie: PF=CXKfmv8tWDIRA04uajbWlk;Path=/;Secure;HttpOnly<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">Transfer-Encoding: chunked<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console""><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console"">171<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:8.5pt;font-family:"Lucida Console""><S11:Envelope xmlns:S11="http://schemas.xmlsoap.org/soap/envelope/"><S11:Body><S11:Fault><faultcode xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">soapenv:Server</faultcode><faultstring>Incoming
binding urn:oasis:names:tc:SAML:2.0:bindings:SOAP is not enabled for (SP) ::: <a href="https://sdauth.sciencedirect.com/%3c/faultstring%3e%3c/S11:Fault%3e%3c/S11:Body%3e%3c/S11:Envelope">
<span style="color:blue">https://sdauth.sciencedirect.com/</faultstring></S11:Fault></S11:Body></S11:Envelope</span></a>><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Lucida Console"">0</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The metadata extract we have for the partner IDP contains the following, so things seems to be in order at our end (on the SP side) in relation to our Relying Party and defining the appropriate Binding.<o:p></o:p></p>
<p class="MsoNormal">(…) <o:p></o:p></p>
<p class="MsoNormal"><md:AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><o:p></o:p></p>
<p class="MsoNormal"> <!--md:AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https:// idp.domain:9443/idp/attrsvc.ssaml2"/--><o:p></o:p></p>
<p class="MsoNormal"> <md:AttributeService Location="https://idp.domain:9443/idp/attrsvc.ssaml2" Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/><o:p></o:p></p>
<p class="MsoNormal"> <md:NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</md:NameIDFormat><o:p></o:p></p>
<p class="MsoNormal"> <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat><o:p></o:p></p>
<p class="MsoNormal"></md:AttributeAuthorityDescriptor><o:p></o:p></p>
<p class="MsoNormal">(…) <o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D">Would anyone know if the ‘Binding not enabled for (SP)…’ issue is something that the IDP needs to configure for our SP, or if that is something potentially wrongly configured in our Service Provider.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D">Christian.</span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1F497D"><br>
________________________________________________________<br>
</span><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0080C0"></span></b><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#FF8040">Christian Pruvost</span></b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#FF8040"> </span><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1F497D"><br>
</span><b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0080C0">Technical Product Manager</span></b><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#1F497D"><br>
<br>
</span><span lang="EN-US" style="font-size:6.0pt;font-family:"Gill Sans W01 Medium";color:#939598"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<style>P {margin:0cm:margin-bottomL.0001pt;}</style><br>
<hr>
<p><span style="font-size:10pt;font-family:"Arial","sans-serif"">Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.</span>
<br clear="none">
</p>
</body>
</html>