
<html dir="ltr">


<head>


<meta http-equiv="Content-Type" content="text/html; charset=utf-8">


</head>


<body style="text-align:left; direction:ltr;">


<div>Greetings,</div>


<div><br>


</div>


<div>I'm federating my Shib v3.4.4 IdP with some SP. IdP-initiated SSO works fine but I'm having issues with SP-initiated SSO. I get the following error:</div>


<div><br>


</div>


<div style="margin-left: 3ch;">


<div><b>2019-07-16 11:11:39,487 - 192.168.0.12 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: UnableToDecode</b></div>


<div><b>2019-07-16 11:11:39,486 - 192.168.0.12 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request</b></div>


<div><br>


</div>


</div>


<div>Any idea what the issue is?</div>


<div><br>


</div>


<div>SAML Tracer shows POST to <a href="https://my.idp.ca/idp/profile/Shibboleth/SSO:">


https://my.idp.ca/idp/profile/Shibboleth/SSO</a> but getting error 400 Bad Request:</div>


<div><br>


</div>


<div style="margin-left: 3ch;">


<div>POST <a href="https://login.sheridanc.on.ca/idp/profile/Shibboleth/SSO">https://my.idp.ca/idp/profile/Shibboleth/SSO</a> HTTP/1.1</div>


<div>Host: my.idp.ca</div>


<div>User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0</div>


<div>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8</div>


<div>Accept-Language: en-CA,en-US;q=0.7,en;q=0.3</div>


<div>Accept-Encoding: gzip, deflate, br</div>


<div>Referer: <a href="https://www.linkedin.com/">https://some.sp.com/</a></div>


<div>Content-Type: application/x-www-form-urlencoded</div>


<div>Content-Length: 937</div>


<div>DNT: 1</div>


<div>Connection: keep-alive</div>


<div>Upgrade-Insecure-Requests: 1</div>


<div><br>


</div>


<div>HTTP/1.1 400 Bad Request</div>


<div>Expires: </div>


<div>Cache-Control: no-store</div>


<div>Content-Type: text/html;charset=utf-8</div>


<div>X-Frame-Options: DENY</div>


<div>Strict-Transport-Security: max-age=0</div>


<div>Content-Security-Policy: frame-ancestors 'none';</div>


<div>Content-Length: 2275</div>


<div>Server: Jetty(9.4.18.v20190429)</div>


<div>Set-Cookie: JSESSIONID=node0m50nnxt9exg419d1qsq8e0js6324708.node0;Path=/idp;Secure;HttpOnly</div>


<div>bigip=1946498958.36895.0000; path=/</div>


<div>bbbbbbbbbbbbbbb=PJNDFFCJIGHOJFABDOLMOAGOGMKIOADNGFOJFJAEEKCDDOLCEHABHPKEJNOAMCBALKNJKAEHHGJNDBMDHOBBBLKMPLJFJKMOEAAKPPEFMLBGGAEGDNEIIAEIGOJGECHE; HttpOnly; secure</div>


</div>


<div></div>


<div><br>


</div>


<div>SAML Auth Request:</div>


<div><br>


</div>


<div>


<div style="margin-left: 3ch;"><span class="hljs-tag"><<span class="hljs-name">saml2p:AuthnRequest</span>


<span class="hljs-attr">Destination</span>=<span class="hljs-string">"https://my.idp.ca/idp/profile/Shibboleth/SSO"</span>


<span class="hljs-attr">ForceAuthn</span>=<span class="hljs-string">"false"</span>


<span class="hljs-attr">ID</span>=<span class="hljs-string">"LI_qd47rn684941iui6hebvqmdqc4"</span>


<span class="hljs-attr">IsPassive</span>=<span class="hljs-string">"false"</span>


<span class="hljs-attr">IssueInstant</span>=<span class="hljs-string">"2019-07-16T15:18:29.733Z"</span>


<span class="hljs-attr">ProtocolBinding</span>=<span class="hljs-string">"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"</span>


<span class="hljs-attr">Version</span>=<span class="hljs-string">"2.0"</span> <span class="hljs-attr">


xmlns:saml2p</span>=<span class="hljs-string">"urn:oasis:names:tc:SAML:2.0:protocol"</span> ></span>


<span class="hljs-tag"><<span class="hljs-name">saml2:Issuer</span> <span class="hljs-attr">


xmlns:saml2</span>=<span class="hljs-string">"urn:oasis:names:tc:SAML:2.0:assertion"</span>></span>https://some.sp.com/someEndPoint/ABEAAAAAAAAirCEAAAAAAuNRbAHzAzyYcMFFTC97fZ9C4TfaBxvDtg<span class="hljs-tag"></<span class="hljs-name">saml2:Issuer</span>></span>


<span class="hljs-tag"><<span class="hljs-name">saml2p:NameIDPolicy</span> <span class="hljs-attr">


AllowCreate</span>=<span class="hljs-string">"true"</span> /></span> <span class="hljs-tag">


</<span class="hljs-name">saml2p:AuthnRequest</span>></span></div>


<div style="margin-left: 3ch;"><span class="hljs-tag"><br>


</span></div>


<span class="hljs-tag ">regards,</span></div>


<div><span class="hljs-tag ">Ryan</span></div>


<div></div>


</body>


</html>