<div dir="ltr">Hi all<div>Can anyone help ?</div><div><br></div><div>Thanks</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 21, 2017 at 5:05 PM, Santu Ghosh <span dir="ltr"><<a href="mailto:mon.snahasish@gmail.com" target="_blank">mon.snahasish@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hi David,</div><div><br></div><div>I have tried with URL encoding but no luck :( </div><div><br></div><div>I observed that when I am trying IDP initiated flow with testshib SP url <span style="color:rgb(26,26,166);font-family:monospace;font-size:13px"><a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/<wbr>shibboleth-sp</a>, </span><span style="font-family:monospace;font-size:13px"><font color="#000000">its working fine.</font></span></div><div><span style="font-family:monospace;font-size:13px"><font color="#444444">Full IDP initiated url is : </font></span><font color="#1a1aa6" face="monospace"><a href="https://idp.xxxxx.com/idp/profile/SAML2/Unsolicited/SSO?providerId=https://sp.testshib.org/shibboleth-sp" target="_blank">https://idp.xxxxx.com/idp/<wbr>profile/SAML2/Unsolicited/SSO?<wbr>providerId=https://sp.<wbr>testshib.org/shibboleth-sp</a></font></div><div><font color="#000000" face="monospace">But the same thing is not working when I am using my SP url (although SP initiated authentication is working fine for my SP).</font></div><div><font color="#000000" face="monospace"><br></font></div><div><font color="#000000" face="monospace">Now I am really confused where the problem is. </font></div><div><font color="#000000" face="monospace"><br></font></div><div><font color="#000000" face="monospace">Attaching my full SP metadata xml, could you please verify it once and suggest me where is the actual issue and how to resolve the same.</font></div><div><font color="#000000" face="monospace"><br></font></div><div><font color="#000000" face="monospace">------------------------------<wbr>-</font></div><div><font face="monospace"><div><font color="#674ea7"><?xml version="1.0" encoding="UTF-8"?><md:<wbr>EntityDescriptor xmlns:md="urn:oasis:names:tc:<wbr>SAML:2.0:metadata" ID="https___shibboleth-sp-<wbr>xxxxx.com_shibboleth-sp" entityID="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp" target="_blank">https://shibboleth-<wbr>sp-xxxxx.com/shibboleth-sp</a>"><<wbr>ds:Signature xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#</a>"><ds:<wbr>SignedInfo><ds:<wbr>CanonicalizationMethod Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/<wbr>2001/10/xml-exc-c14n#</a>"/><ds:<wbr>SignatureMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#rsa-sha1</a>"/><<wbr>ds:Reference URI="#https___shibboleth-sp-<wbr>xxxxx.com_shibboleth-sp"><ds:<wbr>Transforms><ds:Transform Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#enveloped-<wbr>signature</a>"/><ds:Transform Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/<wbr>2001/10/xml-exc-c14n#</a>"/></ds:<wbr>Transforms><ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#sha1</a>"/><ds:<wbr>DigestValue>OreU/<wbr>14CANZdlXlhfpOdBwvjv3E=</ds:<wbr>DigestValue></ds:Reference></<wbr>ds:SignedInfo><ds:<wbr>SignatureValue><wbr>I0g7LWoPmja4lyu/<wbr>9HlOeV71rD8djAcSPRVgnEESwMIgcL<wbr>MR1cacc3HUaztSOE6cwmP+nk/<wbr>vnfhxdp3mSlMnxlwiJVpODSuBZAdSL<wbr>cMHKy4W0Ah9205X1ev+HqAEz/<wbr>7VxPke2/dv1rV4bonvs49MA+<wbr>qCe54F9XtgfoTeVPY+<wbr>gDqWMerrtUj9G92p2w0F/VIjE50A==<wbr></ds:SignatureValue><ds:<wbr>KeyInfo><ds:X509Data><ds:<wbr>X509Certificate><wbr>MIIDUjCCAjqgAwIBAgIEUOLIQTANBg<wbr>kqhkiG9w0BAQUFADBrMQswCQYDVQQG<wbr>EwJGSTEQMA4GA1UE</font></div><div><font color="#674ea7">CBMHVXVzaW1hYTERMA8GA1UEBxMISG<wbr>Vsc2lua2kxGDAWBgNVBAoTD1JNNSBT<wbr>b2Z0d2FyZSBPeTEM</font></div><div><font color="#674ea7">MAoGA1UECwwDUiZEMQ8wDQYDVQQDEw<wbr>ZhcG9sbG8wHhOksjQN7xoQZLj9xXef<wbr>xCFQ69FPcFDeEW</font></div><div><font color="#674ea7">bHwSoBy5hLPNALaEUoa5zPDwlixwRj<wbr>FQTc5XXaRpgIjy/2gsL8+<wbr>Y5QRhyXnLqgO67BlLYW/GuHE=</ds:<wbr>X509Certificate></ds:X509Data><wbr></ds:KeyInfo></ds:Signature><<wbr>md:SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="<wbr>urn:oasis:names:tc:SAML:2.0:<wbr>protocol"><md:KeyDescriptor use="signing"><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#</a>"><ds:<wbr>X509Data><ds:X509Certificate><wbr>MIIDUjCCAjqgAwIBAgIEUOLIQTANBg<wbr>kqhkiG9w0BAQUFADBrMQswCQYDVQQG<wbr>EwJGSTEQMA4GA1UE</font></div><div><font color="#674ea7">CBMHVXVzaW1hYTERMA8GA1UEBxMISG<wbr>Vsc2lua2kxGDAWBgNVBAoTD1JNNSBT<wbr>b2Z0d2FyZSBPeTEM</font></div><div><font color="#674ea7">MAoGA1UECwwDUiZEMQ8wDQYDVQQDEw<wbr>ZhcG9sbG8wHhcNMTVQ49zRvi5qWNRt<wbr>tiFQ69FPcFDeEW</font></div><div><font color="#674ea7">bHwSoBy5hLPNALaEUoa5zPDwlixwRj<wbr>FQTc5XXaRpgIjy/2gsL8+<wbr>Y5QRhyXnLqgO67BlLYW/GuHE=</ds:<wbr>X509Certificate></ds:X509Data><wbr></ds:KeyInfo></md:<wbr>KeyDescriptor><md:<wbr>KeyDescriptor use="encryption"><ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/<wbr>2000/09/xmldsig#</a>"><ds:<wbr>X509Data><ds:X509Certificate><wbr>MIIDUjCCAjqgAwIBAgIEUOLIQTANBg<wbr>kqhkiG9w0BAQUFADBrMQswCQYDVQQG<wbr>EwJGSTEQMA4GA1UE</font></div><div><font color="#674ea7">CBMHVXVzaW1hYTERMA8GA1UEBxMISG<wbr>Vsc2lua2kxGDAWBgNVBAoTD1JNNSBT<wbr>b2ZFQ69FPcFDeEW</font></div><div><font color="#674ea7">bHwSoBy5hLPNALaEUoa5zPDwlixwRj<wbr>FQTc5XXaRpgIjy/2gsL8+<wbr>Y5QRhyXnLqgO67BlLYW/GuHE=</ds:<wbr>X509Certificate></ds:X509Data><wbr></ds:KeyInfo></md:<wbr>KeyDescriptor><md:<wbr>SingleLogoutService Binding="urn:oasis:names:tc:<wbr>SAML:2.0:bindings:HTTP-POST" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SingleLogout" target="_blank">https://shibboleth-<wbr>sp-xxxxx.com/shibboleth-sp/<wbr>saml/SingleLogout</a>"/><md:<wbr>SingleLogoutService Binding="urn:oasis:names:tc:<wbr>SAML:2.0:bindings:HTTP-<wbr>Redirect" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SingleLogout" target="_blank">https://shibboleth-<wbr>sp-xxxxx.com/shibboleth-sp/<wbr>saml/SingleLogout</a>"/><md:<wbr>NameIDFormat>urn:oasis:names:<wbr>tc:SAML:1.1:nameid-format:<wbr>emailAddress</md:NameIDFormat><wbr><md:NameIDFormat>urn:oasis:<wbr>names:tc:SAML:2.0:nameid-<wbr>format:transient</md:<wbr>NameIDFormat><md:NameIDFormat><wbr>urn:oasis:names:tc:SAML:2.0:<wbr>nameid-format:persistent</md:<wbr>NameIDFormat><md:NameIDFormat><wbr>urn:oasis:names:tc:SAML:1.1:<wbr>nameid-format:unspecified</md:<wbr>NameIDFormat><md:NameIDFormat><wbr>urn:oasis:names:tc:SAML:1.1:<wbr>nameid-format:X509SubjectName<<wbr>/md:NameIDFormat><md:<wbr>AssertionConsumerService Binding="urn:oasis:names:tc:<wbr>SAML:2.0:bindings:HTTP-POST" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SSO" target="_blank">https://shibboleth-<wbr>sp-xxxxx.com/shibboleth-sp/<wbr>saml/SSO</a>" index="0" isDefault="true"/><md:<wbr>AssertionConsumerService Binding="urn:oasis:names:tc:<wbr>SAML:2.0:bindings:HTTP-<wbr>Artifact" Location="<a href="https://shibboleth-sp-xxxxx.com/shibboleth-sp/saml/SSO" target="_blank">https://shibboleth-<wbr>sp-xxxxx.com/shibboleth-sp/<wbr>saml/SSO</a>" index="1"/></md:<wbr>SPSSODescriptor></md:<wbr>EntityDescriptor></font></div><div style="color:rgb(0,0,0)"><br></div><div style="color:rgb(0,0,0)">------------------------------<wbr>---------</div></font></div><div><font color="#000000" face="monospace"><br></font></div><div>Please help. Many thanks.</div><div><br></div><div><br></div><div>Snahasish</div><br><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Mon, Nov 20, 2017 at 9:26 PM, David Huebner <span dir="ltr"><<a href="mailto:david.huebner@daasi.de" target="_blank">david.huebner@daasi.de</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div class="h5">
<div bgcolor="#FFFFFF">
<tt>Since you are masking all the relevant URLs please make sure
that the entityID in the metadata exactly matches the one you try
to initiate SSO with.</tt><tt><br>
</tt><tt><br>
</tt><tt>Oh and you probably have to URL-encode the entityID when
requesting SSO.</tt><tt><br>
</tt><tt><br>
</tt><tt>Refer to the examples in
<a class="m_-5963018667156902358gmail-m_-4973865335710891534moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/display/IDP30/Unsolic<wbr>itedSSOConfiguration</a></tt><div><div class="m_-5963018667156902358gmail-h5"><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534moz-cite-prefix"><tt>On 20.11.2017 15:52, Santu Ghosh
wrote:</tt><tt><br>
</tt></div>
<blockquote type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt>Hi David,</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt>Thanks for your response.</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><span style="font-size:10.4px">- you did not register the SP in your IdP (i.e.
load metadata of the SP)</span></tt><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><span style="font-size:10.4px">
This is working fine if we test SP initiated flow</span></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><span style="font-size:10.4px"><br>
</span></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt>-the entityID in your URL
does not match the entityID in the metadata file</tt><tt><br>
</tt><tt>- you did add the metadata but forgot to reload the
MetadataResolverService (or just restart Tomcat/Jetty)</tt><span style="font-size:10.4px"><br>
</span></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt> We have done above
mentioned two steps every time when we made any changed
(if necessary) in xml.</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt>Our IDP metadata looks like :</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><EntityDescriptor
xmlns="urn:oasis:names:tc:SAML<wbr>:2.0:metadata" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/20<wbr>00/09/xmldsig#</a>"
xmlns:shibmd="urn:mace:shibbol<wbr>eth:metadata:1.0"
xmlns:mdui="urn:oasis:names:tc<wbr>:SAML:metadata:ui"
entityID="<a href="https://idp.xxxxxxxx.com/idp/shibboleth" target="_blank">https://idp.xxxxxxxx<wbr>.com/idp/shibboleth</a>"></font></tt><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt>And SP metadata looks like :</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><?xml
version="1.0"
encoding="UTF-8"?><md:EntityDe<wbr>scriptor
xmlns:md="urn:oasis:names:tc:S<wbr>AML:2.0:metadata"
ID="https___shibboleth-sp.xxxx<wbr>xxx.com_shibboleth-sp"
entityID="<a href="https://shibboleth-sp.xxxxxxxx.com/shibboleth-sp" target="_blank">https://shibboleth-s<wbr>p.xxxxxxxx.com/shibboleth-sp</a>"><wbr><ds:Signature
xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" target="_blank">http://www.w3.org/20<wbr>00/09/xmldsig#</a>"><ds:SignedInfo<wbr>><ds:CanonicalizationMethod
Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2<wbr>001/10/xml-exc-c14n#</a>"/><ds:Sig<wbr>natureMethod
Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#rsa-sha1" target="_blank">http://www.w3.org/2<wbr>000/09/xmldsig#rsa-sha1</a>"/><ds:<wbr>Reference
URI="#https___shibboleth-sp.xx<wbr>xxxxx.com_shibboleth-sp"><ds:<wbr>Transforms><ds:Transform
Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#enveloped-signature" target="_blank">http://www.w3.org/2<wbr>000/09/xmldsig#enveloped-signa<wbr>ture</a>"/><ds:Transform
Algorithm="<a href="http://www.w3.org/2001/10/xml-exc-c14n#" target="_blank">http://www.w3.org/2<wbr>001/10/xml-exc-c14n#</a>"/></ds:Tr<wbr>ansforms><ds:DigestMethod
Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1" target="_blank">http://www.w3.org/2<wbr>000/09/xmldsig#sha1</a>"/><ds:Dige<wbr>stValue>OreU/14CANZdlXlhfpOdBw<wbr>vjv3E=</ds:DigestValue></ds:<wbr>Reference></ds:SignedInfo><ds:<wbr>SignatureValue>I0g7LWoPmja4lyu<wbr>/9H</font></tt><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><br>
</font></tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><font color="#0000ff"><br>
</font></tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt>Can you please take a look.</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt><br>
</tt></div>
<div class="m_-5963018667156902358gmail-m_-4973865335710891534gmail_signature"><tt>Snahasish</tt></div>
</div>
</div>
<tt><br>
</tt>
<fieldset class="m_-5963018667156902358gmail-m_-4973865335710891534mimeAttachmentHeader"></fieldset>
<tt><br>
</tt>
</blockquote>
<tt><br>
</tt>
</div></div></div>
<br></div></div><span class="">--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br></span></blockquote></div><span class=""><br><br clear="all"><div><br></div>-- <br><div class="m_-5963018667156902358gmail_signature">Snahasish Ghosh<br>System Engineer.<br>Mobile No- (0)9733960336<br></div>
</span></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">Snahasish Ghosh<br>System Engineer.<br>Mobile No- (0)9733960336<br></div>
</div>