<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 5/23/19 6:37 PM, Garmer, Jack -
garmercj wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7f230cd9f5c74ac0baade1216cab97be@jmu.edu">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1"><br>
<p class="MsoNormal">We’re attempting to authenticate against
our development idp environment, it-federation-dev.jmu.edu. In
the shibd.log on the SP side, we’re seeing this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">2019-05-23
18:26:38 DEBUG OpenSAML.MessageEncoder.SAML2Redirect [2]
[default]: marshalled message:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><samlp:AuthnRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL=<a class="moz-txt-link-rfc2396E" href="https://itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST">"https://itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST"</a>
Destination=<a
href="https://it-federation-dev.jmu.edu/idp/profile/SAML2/Redirect/SSO"
moz-do-not-send="true">https://it-federation-dev.jmu.edu/idp/profile/SAML2/Redirect/SSO</a>
ID="_1648fa9b7458e5bb02050562e7902c54"
IssueInstant="2019-05-23T22:26:38Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a class="moz-txt-link-freetext" href="https://itsmapi.jmu.edu/shibboleth">https://itsmapi.jmu.edu/shibboleth</a></saml:Issuer><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest></p>
</div>
</blockquote>
<p><br>
</p>
<p>Read on, but look closely at the AssertionConsumerServiceURL
value...<br>
</p>
<p><br>
</p>
<o:p></o:p>
<blockquote type="cite"
cite="mid:7f230cd9f5c74ac0baade1216cab97be@jmu.edu">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the idp side, we see this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in">DEBUG Endpoint
Resolver
org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:
Neither candidate endpoint location
'<a class="moz-txt-link-freetext" href="https://it-itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST">https://it-itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST</a>' nor
response location 'null' matched
'<a class="moz-txt-link-freetext" href="https://itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST">https://itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST</a>'</p>
</div>
</blockquote>
<p><br>
</p>
<p>You have mismatch in the URLs there. https://<b>it-itsmapi</b>.jmu.edu/Shibboleth.sso/SAML2/POST
!= https://<b>itsmapi</b>.jmu.edu/Shibboleth.sso/SAML2/POST</p>
<p>Note presence of "it-" in the former vs absence in the latter.
That's your problem.</p>
<p>The other stuff about Redirect vs POST is a misunderstanding.
The SP is sending the AuthnRequest to the IdP via Redirect and
that's fine. And generally preferred. The Shib SP will prefer
sending the request over Redirect unless you specifically
configure otherwise, or the IdP indicates in its
SingleSignOnService metadata that it doesn't support Redirect
(which would generally be highly unusual). <br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:7f230cd9f5c74ac0baade1216cab97be@jmu.edu">
<div class="WordSection1">
<p class="MsoNormal" style="margin-left:.5in"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">It appears the SP is sending requests to
HTTP-Redirect on our idp and I can’t figure out why. The
metadata on both instruct HTTP-POST as the primary protocol:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">SP:<o:p></o:p></p>
<p class="MsoNormal">
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location=<a class="moz-txt-link-rfc2396E" href="https://it-itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST">"https://it-itsmapi.jmu.edu/Shibboleth.sso/SAML2/POST"</a>
index="0" isdefault="true"/></p>
</div>
</blockquote>
<p><br>
</p>
<p>That's indicating where and how the SP wants the <b>*response*</b>
sent (which has nothing to do with where and how the IdP wants the
request sent). It's the mismatch between this and what's in the
AuthnRequest AssertionConsumerServiceURL that is causing the
mismatch here in the endpoint evaluation.<br>
</p>
</body>
</html>