<div dir="ltr"><div>Hi all, </div><div><br></div><div>I'm new on Shibooleth world. </div><div>I installed and configured an IDP on a Linux server Ubuntu 16.04, following this guide: <a href="https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Identity%20Provider/Ubuntu/HOWTO%20Install%20and%20Configure%20a%20Shibboleth%20IdP%20v3.3.2%20on%20Ubuntu%20Linux%20LTS%2016.04%20with%20Apache2%20%2B%20Jetty9.md">https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Identity%20Provider/Ubuntu/HOWTO%20Install%20and%20Configure%20a%20Shibboleth%20IdP%20v3.3.2%20on%20Ubuntu%20Linux%20LTS%2016.04%20with%20Apache2%20%2B%20Jetty9.md</a></div><div><br></div><div>My first attempt was test it with an online SAML2 test tool: <a href="https://samltest.id/start-idp-test/">https://samltest.id/start-idp-test/</a></div><div><br></div><div>When tried this test, following error is showed:</div><div>"Web Login Service - Message Security Error</div>
<div>The request cannot be fulfilled because the message received
does not meet the security requirements of the login service."</div><div><br></div><div>In Shibboleth log, following lines is showed:</div><div><br></div>2020-03-11 14:32:00,831 - 127.0.0.1 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:200] - Message Handler: SAML message intended destination endpoint '<a href="https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO">https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO</a>' did not match the recipient endpoint '<a href="http://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO">http://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO</a>'<br><div><br></div><div><br></div><div>I figured out that the reason of this error is because there is a difference on http and https between endpoints URLs.</div><div><br></div><div>But i don't understand why is happening that.</div><div><br></div><div>As you can see in the metadata of my IDP is (bellow without certificate info), i write "https" on SingleSignOnService.</div><div><br></div><div>And the Apache configuration of ProxyReverse is:</div><div><br></div><div><IfModule mod_proxy.c><br> ProxyPreserveHost On<br> RequestHeader set X-Forwarded-Proto "https"<br> ProxyPass /idp <a href="http://127.0.0.1:8080/idp">http://127.0.0.1:8080/idp</a> retry=5<br> ProxyPassReverse /idp <a href="http://127.0.0.1:8080/idp">http://127.0.0.1:8080/idp</a> retry=5<br><br> <Location /idp><br> Require all granted<br> </Location><br></IfModule><br></div><div><br></div><div><br></div><div>==================================================</div><div><?xml version="1.0" encoding="UTF-8"?><br><!--<br> This is example metadata only. Do *NOT* supply it as is without review,<br> and do *NOT* provide it in real time to your partners.<br><br> This metadata is not dynamic - it will not change as your configuration changes.<br>--><br><EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="<a href="http://www.w3.org/XML/1998/namespace">http://www.w3.org/XML/1998/namespace</a>" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:req-attr="urn:oasis:names:tc:SAML:protocol:ext:req-attr" validUntil="2020-04-10T15:48:54.555Z" entityID="<a href="https://idp.gusduarte.tech/idp/shibboleth">https://idp.gusduarte.tech/idp/shibboleth</a>"><br><br> <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br><br> <Extensions><br> <shibmd:Scope regexp="false">gusduarte.tech</shibmd:Scope><br><!--<br> Fill in the details for your IdP here <br><br> <mdui:UIInfo><br> <mdui:DisplayName xml:lang="en">A Name for the IdP at idp.gusduarte.tech</mdui:DisplayName><br> <mdui:Description xml:lang="en">Enter a description of your IdP at idp.gusduarte.tech</mdui:Description><br> <mdui:Logo height="80" width="80"><a href="https://idp.gusduarte.tech/Path/To/Logo.png">https://idp.gusduarte.tech/Path/To/Logo.png</a></mdui:Logo><br> </mdui:UIInfo><br>--><br> </Extensions><br><br><br> <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/SOAP/ArtifactResolution">https://idp.gusduarte.tech/idp/profile/SAML2/SOAP/ArtifactResolution</a>" index="1"/><br><br> <!--<br> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SLO">https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SLO</a>"/><br> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/POST/SLO">https://idp.gusduarte.tech/idp/profile/SAML2/POST/SLO</a>"/><br> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/POST-SimpleSign/SLO">https://idp.gusduarte.tech/idp/profile/SAML2/POST-SimpleSign/SLO</a>"/><br> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://idp.gusduarte.tech:8443/idp/profile/SAML2/SOAP/SLO">https://idp.gusduarte.tech:8443/idp/profile/SAML2/SOAP/SLO</a>"/><br> --><br><br> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" req-attr:supportsRequestedAttributes="true" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/POST/SSO">https://idp.gusduarte.tech/idp/profile/SAML2/POST/SSO</a>"/><br> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" req-attr:supportsRequestedAttributes="true" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/POST-SimpleSign/SSO">https://idp.gusduarte.tech/idp/profile/SAML2/POST-SimpleSign/SSO</a>"/><br> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" req-attr:supportsRequestedAttributes="true" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO">https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO</a>"/><br><br> </IDPSSODescriptor><br><br><br> <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br><br> <Extensions><br> <shibmd:Scope regexp="false">gusduarte.tech</shibmd:Scope><br> </Extensions><br><br><br> <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://idp.gusduarte.tech/idp/profile/SAML2/SOAP/AttributeQuery">https://idp.gusduarte.tech/idp/profile/SAML2/SOAP/AttributeQuery</a>"/> <br> <!-- If you uncomment the above you should add urn:oasis:names:tc:SAML:2.0:protocol to the protocolSupportEnumeration above --><br><br> </AttributeAuthorityDescriptor><br><br></EntityDescriptor><br></div><div>=======================================================</div><div><br></div><div><br></div><div>Thanks in advance.</div><div><br></div><div>Gustavo</div></div>