<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 10/4/24 11:45 PM, Paul B. Henson via
users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:PH0PR01MB75233876C5D4421A833C0B87D2732@PH0PR01MB7523.prod.exchangelabs.com">
<pre class="moz-quote-pre" wrap="">I'm seeing a lot of these errors in my logs:
2024-10-04 02:13:01,274 - 20.77.36.136/node0188oi8w1gi31vq7p0mquln0785772 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:202] - Message Handler: SAML message intended destination endpoint '<a class="moz-txt-link-freetext" href="https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO">https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO</a>' did not match the recipient endpoint '<a class="moz-txt-link-freetext" href="https://connectcpp.atriumcampus.com/idp/profile/SAML2/Redirect/SSO">https://connectcpp.atriumcampus.com/idp/profile/SAML2/Redirect/SSO</a>'
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_ea0a81488bf0c951b92d6fdc654c2e9f51de2dec36"
Version="2.0" IssueInstant="2024-10-04T09:12:58Z"
Destination=<a class="moz-txt-link-rfc2396E" href="https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO">"https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO"</a>
AssertionConsumerServiceURL=<a class="moz-txt-link-rfc2396E" href="https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/saml2-acs.php/connectcpp.atriumcampus.com">"https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/saml2-acs.php/connectcpp.atriumcampus.com"</a>
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"> <saml:Issuer><a class="moz-txt-link-freetext" href="https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/metadata.php/connectcpp.atriumcampus.com">https://connectcpp.atriumcampus.com/sso/module.php/saml/sp/metadata.php/connectcpp.atriumcampus.com</a></saml:Issuer>
</samlp:AuthnRequest>
I don't see the mismatch? The issuer exists in metadata, the ACS URL matches the metadata. What exactly is it complaining about? I can't reproduce it, when I try to log in, it works fine, with what looks like basically the same authn request?</pre>
</blockquote>
<p><br>
</p>
<p>In SAML the @Destination value in a protocol message indicates
the URI at which the message must be received by the recipient.
It's to prevent the message from being diverted by a malicious
actor to another endpoint and being unwittingly processed to
nefarious purposes.</p>
<p>In the AuthRequest, the Destination above says it must be
delivered to <a class="moz-txt-link-rfc2396E" href="https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO">"https://idp.cpp.edu/idp/profile/SAML2/Redirect/SSO"</a>.</p>
<p>The request at the IdP is actually seen by the IdP as coming into
<a class="moz-txt-link-rfc2396E" href="https://connectcpp.atriumcampus.com/idp/profile/SAML2/Redirect/SSO">"https://connectcpp.atriumcampus.com/idp/profile/SAML2/Redirect/SSO"</a>.
That 'recipient endpoint' in the log message is computed in the
IdP from the web request info, i.e. what the web server is
reporting to the IdP app. Essentially it's what's in the
HttpServletRequest.</p>
<p>Possibly there is some intended virtual host stuff going on here,
perhaps configured incorrectly. But that is what the IdP "sees"
as the actual delivered endpoint at which it is processing the
request.</p>
<p>And since that doesn't match the message Destination value,
that's the error.</p>
<p>--Brent<br>
</p>
</body>
</html>