<div dir="ltr">I have a vendor whose SP does not include the endpoint for our instance during endpoint resolution.  It provides the endpoints for other customers, just not ours.  As such, Shibboleth 3.3.3 dutifully stops the login process and logs the reason why:<div><br></div><div><font face="monospace">2020-05-05 17:40:06,324 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:220] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Returning 2 candidate endpoints of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService<br>2020-05-05 17:40:06,324 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:126] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Neither candidate endpoint location '<a href="https://app.chromeriver.com/login/sso/saml/consume?customerId=527">https://app.chromeriver.com/login/sso/saml/consume?customerId=527</a>' nor response location 'null' matched '<a href="https://app.ca1.chromeriver.com/login/sso/saml/consume?customerId=833">https://app.ca1.chromeriver.com/login/sso/saml/consume?customerId=833</a>'<br>2020-05-05 17:40:06,324 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:126] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Neither candidate endpoint location '<a href="https://app.chromeriver.com/login/sso/saml/consume?customerId=514">https://app.chromeriver.com/login/sso/saml/consume?customerId=514</a>' nor response location 'null' matched '<a href="https://app.ca1.chromeriver.com/login/sso/saml/consume?customerId=833">https://app.ca1.chromeriver.com/login/sso/saml/consume?customerId=833</a>'<br>2020-05-05 17:40:06,324 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:130] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: No candidate endpoints met criteria<br>2020-05-05 17:40:06,325 - WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:410] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint for relying party '<a href="http://www.chromeriver.com">http://www.chromeriver.com</a>': EndpointCriterion [type={urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService, Binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, Location=<a href="https://app.ca1.chromeriver.com/login/sso/saml/consume?customerId=833">https://app.ca1.chromeriver.com/login/sso/saml/consume?customerId=833</a>, trusted=false]<br>2020-05-05 17:40:06,351 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: EndpointResolutionFailed<br clear="all"></font><div><br></div><div>Both the vendor's tech support and myself agree that the endpoint in the metadata is correct, but the SP is not listing it back to the IdP for reasons unknown.  I'd much rather have the SP send back the expected endpoint, but if it doesn't, is there an advisable configuration on the IdP side that would help?  </div><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div dir="ltr">Jeffrey Williams </div><div dir="ltr">Identity Engineer<br>Identity & Access Services<br><a href="https://its.uncg.edu" target="_blank">https://its.uncg.edu</a></div></div><div dir="ltr"><br></div><div dir="ltr"><img src="https://uncgcdn.blob.core.windows.net/email/UNCGLogo.png"><br></div></div></div></div></div></div></div></div></div></div></div>