<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been tasked with implementing proxying from our Shib IDP to Okta, to provide MFA for specific Shibboleth SPs. I have a test IDP running 4.3.1, and I’ve followed the SAMLAuthnConfiguration wiki docs for 4.0:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">and the “Using SAML Proxying to another IdP” wiki article as well, with the understanding that some configuration may be out of date for 4.1:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP">https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Per the above article, I created a Shib-sp-metadata.xml file and included the following in Metadata-providers.xml:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <MetadataProvider id="ShibSPMetadata" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/sp-metadata.xml"/><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <MetadataProvider id="OktaIDPMetadata" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/OktaIDPmetadata.xml"/><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">After configuration according to the documentation, when accessing an SP authentication at the upstream IDP succeeds, but my Shib IDP responds with “Web Login Service – Unsupported request. The application you have accessed is not registered
for use with this service.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My logs show that my upstream IDP’s metadata is being loaded, as is the metadata for the Shib SP:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,749 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Releasing cached DOM for metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,749 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Post-processing metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,749 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Computing expiration time for metadata from 'C:\Program Files
(x86)\Shibboleth\IdP\metadata\sp-metadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,749 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Expiration of metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'
will occur at 2024-02-24T02:42:47.749770900Z<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,749 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: New metadata successfully loaded for 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Next refresh cycle for metadata provider 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'
will occur on '2024-02-24T01:42:47.749770900Z' ('2024-02-23T19:42:47.749770900-06:00[America/Chicago]' local time)<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Beginning refresh of metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Processing new metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Unmarshalling metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Preprocessing metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Applying metadata filter<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:?] - Applying filter net.shibboleth.idp.saml.metadata.impl.ByReferenceMetadataFilterBridge<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [net.shibboleth.idp.saml.metadata.impl.ByReferenceMetadataFilterBridge:?] - Bridging to 0 ByReference filters in Spring context<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:?] - No filters configured, nothing to do<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:?] - Applying filter org.opensaml.saml.metadata.resolver.filter.impl.NodeProcessingMetadataFilter<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Releasing cached DOM for metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Post-processing metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Computing expiration time for metadata from 'C:\Program Files
(x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Expiration of metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
will occur at 2024-02-24T02:42:47.765395100Z<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: New metadata successfully loaded for 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:42:47,765 - - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Next refresh cycle for metadata provider 'C:\Program Files
(x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml' will occur on '2024-02-24T01:42:47.765395100Z' ('2024-02-23T19:42:47.765395100-06:00[America/Chicago]' local time)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In my logs I see the incoming assertion, but the logs indicate the upstream IDP’s metadata cannot be verified, resulting in a shibboleth.UnverifiedRelyingParty condition.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractBatchMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Resolved 1 candidates via EntityIdCriterion: EntityIdCriterion
[id=http://www.okta.com/exk137opma7Z4PsLC0x8]<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Attempting to filter candidate EntityDescriptors via resolved
Predicates<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: After predicate filtering 1 EntityDescriptors remain<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Resolved 1 source EntityDescriptors<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Resolved 0 RoleDescriptor candidates via role criteria, performing predicate filtering<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Candidates iteration was empty, nothing to filter via predicates<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:?] - Message Handler: No metadata returned for http://www.okta.com/exk137opma7Z4PsLC0x8 in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor
with protocol urn:oasis:names:tc:SAML:2.0:protocol<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler'
on INBOUND message context<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler:?] - Message Handler: No metadata context found, nothing to do<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:?] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer
http://www.okta.com/exk137opma7Z4PsLC0x8<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:?] - Resolving relying party configuration<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:?] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:?] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for
request<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:170] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for
RP configuration shibboleth.UnverifiedRelyingParty (RPID http://www.okta.com/exk137opma7Z4PsLC0x8)<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration<o:p></o:p></p>
<p class="MsoNormal">2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:?] - No SAMLBindingContext or binding URI available, error must be handled locally<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I feel like I’m missing something obvious, but I’m not sure what. Any guidance would be appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dave<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">David Jewett<o:p></o:p></p>
<p class="MsoNormal">Client/Server Administrator<o:p></o:p></p>
<p class="MsoNormal">Texas Christian University<o:p></o:p></p>
</div>
</body>
</html>