<div dir="ltr"><div>Nate you was right, many thanks!</div><div>I felt that I missed something important. I forgot to provide certificates that time.</div><div>Now it works properly.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 20 Apr 2019 at 03:18, Nate Klingenstein <<a href="mailto:ndk@signet.id">ndk@signet.id</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Yakov,<br>
<br>
You can send redirect requests with a POSTed assertion. It's the most common paradigm.<br>
<br>
I'd ignore the deprecation warnings for the moment because your problem is here:<br>
<br>
> 2019-04-19 23:48:49,196 - 184.170.232.52 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:117] - Profile Action SelectProfileConfiguration: Profile <a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser</a> <<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser</a>> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID Cyberark4Hide)<br>
> 2019-04-19 23:48:49,214 - 184.170.232.52 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration<br>
<br>
Which means your IdP doesn't trust this SP for some reason. If you look at the IdP logs during startup, it'll tell you about metadata errors. I assume all the spurious URL's were added by your mail client.<br>
<br>
Are you trusting the IdP metadata at all through metadata-providers.xml? You can do a sanity check on either provider using SAMLtest.id if you want.<br>
<br>
Thanks,<br>
Nate.<br>
<br>
-----Original message-----<br>
> From: Yakov Revyakin<br>
> Sent: Friday, April 19 2019, 3:00 pm<br>
> To: Shib Users<br>
> Subject: Re: Problem Cyberark PVWA as SP<br>
> <br>
> <br>
> <br>
> Hi Nate,<br>
> <br>
> I tried Redirect before with no success. I get a screen with Unsupported Request as well as lines in log look like:<br>
> <br>
> 2019-04-19 23:46:46,301 - - WARN [DEPRECATED:118] - XML Element SourceAttribute, (file [D:\Soft\shibboleth-idp\conf\attribute-resolver.xml]): This will be removed in the next major version of this software; replacement is by using <InputAttributeDefinition> and <InputDataConnector><br>
> 2019-04-19 23:46:48,618 - - WARN [DEPRECATED:118] - Spring bean c14n/LegacyPrincipalConnector, (c14n/subject-c14n.xml): This will be removed in the next major version of this software; replacement is <remove><br>
> 2019-04-19 23:48:49,196 - 184.170.232.52 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:117] - Profile Action SelectProfileConfiguration: Profile <a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser</a> <<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" rel="noreferrer" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser</a>> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID Cyberark4Hide)<br>
> 2019-04-19 23:48:49,214 - 184.170.232.52 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration<br>
> <br>
> I wrote SP metadata as:<br>
> <br>
> <?xml version="1.0" encoding="UTF-8"?><br>
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#" rel="noreferrer" target="_blank">http://www.w3.org/2000/09/xmldsig#</a> <<a href="http://www.w3.org/2000/09/xmldsig#" rel="noreferrer" target="_blank">http://www.w3.org/2000/09/xmldsig#</a>>" entityID="Cyberark4Hide" validUntil="2025-12-09T09:13:31.006Z"><br>
> <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>
> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><br>
> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://components.cyberark.local/PasswordVault/api/auth/saml/logon" rel="noreferrer" target="_blank">https://components.cyberark.local/PasswordVault/api/auth/saml/logon</a> <<a href="https://components.cyberark.local/PasswordVault/api/auth/saml/logon" rel="noreferrer" target="_blank">https://components.cyberark.local/PasswordVault/api/auth/saml/logon</a>>" index="0" isDefault="true"/><br>
> </md:SPSSODescriptor><br>
> </md:EntityDescriptor><br>
> <br>
> On Fri, 19 Apr 2019 at 19:57, Nate Klingenstein <<a href="mailto:ndk@signet.id" target="_blank">ndk@signet.id</a> <mailto:<a href="mailto:ndk@signet.id" target="_blank">ndk@signet.id</a>>> wrote:<br>
> <br>
> Yakov,<br>
> <br>
> Youre sending a GET AuthnRequest to a POST decoder. Pick one or the other, and Id recommend the redirect option.<br>
> <br>
> Thanks,<br>
> <br>
> Nate.<br>
> <br>
> --<br>
> <br>
> For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a> <<a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a>><br>
> <br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a> <mailto:<a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a>><br>
> <br>
> --<br>
> <br>
> For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
> <br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
> <br>
> <br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>