<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have set up a new SP in Shibboleth IdP 4.2.1.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When I try to login using url:<br>
<a href="https://shibboleth-staging.vmock.com/vmock/shib/Shibboleth.sso/Login?entityID=https%3A%2F%2Fsso.hbsstg.org%2Fidp%2Fshibboleth&target=https://shibboleth-staging.vmock.com/vmock/shib/attributes.php">https://shibboleth-staging.vmock.com/vmock/shib/Shibboleth.sso/Login?entityID=https%3A%2F%2Fsso.hbsstg.org%2Fidp%2Fshibboleth&target=https://shibboleth-staging.vmock.com/vmock/shib/attributes.php</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I get the following error message:<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,011 - - DEBUG [org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:213] - Profile Action PopulateSignatureSigningParameters: Signing not enabled<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,053 - - DEBUG [org.opensaml.saml.common.profile.impl.VerifyChannelBindings:156] - Profile Action VerifyChannelBindings: No channel bindings found to verify, nothing to do<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,064 - - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:169] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.saml2.binding.impl.ExtractProxiedRequestersHandler'
on INBOUND message context<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,064 - - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:190] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,190 - - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:213] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,208 - - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,209 - - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:79] - Profile Action FilterFlowsByForcedAuthn:
<span style="background:yellow;mso-highlight:yellow">Removing flow authn/RemoteUser, it does not support forced authentication</span><o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,209 - - INFO [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:86] - Profile Action FilterFlowsByForcedAuthn:
<span style="background:yellow;mso-highlight:yellow">No potential authentication flows remain after filtering</span><o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,210 - - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:57] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,214 - - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile Action SelectAuthenticationFlow: No specific Principals requested<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,214 - - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:277] - Profile Action SelectAuthenticationFlow: Forced authentication requested, selecting an inactive flow<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,215 - - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:281] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,227 - - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:172] - Error event NoPotentialFlow will be handled with response<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,241 - - DEBUG [org.opensaml.saml.saml2.profile.impl.AbstractResponseShellAction:216] - Profile Action AddStatusResponseShell: Setting Issuer to
<a href="https://sso.hbsstg.org/idp/shibboleth">https://sso.hbsstg.org/idp/shibboleth</a><o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,251 - - DEBUG [org.opensaml.saml.common.profile.impl.AddInResponseToToResponse:107] - Profile Action AddInResponseToToResponse: Attempting to add InResponseTo to outgoing Response<o:p></o:p></p>
<p class="MsoNormal">2024-11-14 17:01:43,263 - - DEBUG [org.opensaml.saml.saml2.profile.impl.AddStatusToResponse:191] - Profile Action AddStatusToResponse: Detailed errors are disabled<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here are the IdP configurations (SP metadata attached):<br>
<u>metadata.xml:</u><br>
<!-- ============ <u>Vmock</u> Setup ========== --><o:p></o:p></p>
<p class="MsoNormal"> <MetadataProvider id=<i>"VmockMD"</i><o:p></o:p></p>
<p class="MsoNormal"> xsi:type=<i>"FilesystemMetadataProvider"</i><o:p></o:p></p>
<p class="MsoNormal"> metadataFile=<i>"%{idp.home}/metadata/vmock-metadata.xml"</i>/<u>></u><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><u>relying-party.xml:</u><br>
<!-- VMock --><o:p></o:p></p>
<p class="MsoNormal"> <bean parent=<i>"RelyingPartyByName"</i> c:relyingPartyIds=<i>"https://shibboleth-staging.vmock.com/vmock/shibboleth-sp"</i>><o:p></o:p></p>
<p class="MsoNormal"> <property name=<i>"profileConfigurations"</i>><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <bean parent=<i>"SAML2.SSO"</i>><o:p></o:p></p>
<p class="MsoNormal"> <property name=<i>"encryptAssertions"</i> value=<i>"false"</i> /><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Instead of taking me to the login page, it redirects me back to the vendor with the following message:<o:p></o:p></p>
<p class="MsoNormal">Session Error<br>
requestURL: https://shibboleth-staging.vmock.com/vmock/shib/Shibboleth.sso/SAML2/POST<br>
errorType: opensaml::FatalProfileException<br>
errorText: SAML response reported an IdP error.<br>
entityID: https://sso.hbsstg.org/idp/shibboleth<br>
statusCode: urn:oasis:names:tc:SAML:2.0:status:Requester<br>
statusCode2: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed<br>
statusMessage: An error occurred.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please let me know if you have any suggestions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Sunil<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>