Error Message: No peer endpoint available to which to send SAML response

Question

I installed Shibboleth SP on my mac. I try to make a connect with the test shib. However, I get this error after I login.

 Error Message: No peer endpoint available to which to send SAML response 

Here's my Shibboleth2.xml

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
          checkAddress="false" handlerSSL="false" cookieProps="http">


    <SSO entityID="https://idp.testshib.org/idp/shibboleth"
         discoveryProtocol="SAMLDS" forceAuthn="true">
      SAML2 SAML1
    </SSO>


    <MetadataProvider type="XML" uri="http://www.testshib.org/metadata/testshib-providers.xml"
          backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000">
    </MetadataProvider>

here's my metadata

 <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost/Shibboleth.sso/SAML2/POST" index="1"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://localhost/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://localhost/Shibboleth.sso/SAML2/ECP" index="3"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://localhost/Shibboleth.sso/SAML/POST" index="4"/>

Why I am getting this error?

Answer 1

This message indicates a mismatch between the configuration of the Testshib Identity Provider and your Shibboleth Service Provider you tried logging in to. I would suspect a problem caused by using the name "localhost" in the Assertion Consumer Service URL provided with your metadata. The IDP is trying to send the SAML response to https://localhost/Shibboleth.sso/SAML2/POST , but there is of course no Assertion Consumer Service because "localhost" is in this case the IDP itself.

So, I would start by removing everything from Testshib, changing your SP's entityID to make it more unique (Use your IP address instead of localhost) and re-add updated metadata for your SP to TestShib.

Answer 2

Try the request, then Testshib's idp logs at https://idp.testshib.org/cgi-bin/idplog.cgi?lines=300 . For me, there was an error message like this:

05:15:03.350 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] -
Relying party 'my.entity.id' requested the response to be returned to endpoint with ACS
URL 'https://wrong-host/Shibboleth.sso/SAML2/POST'  and binding 'urn:oasis:names:tc:
SAML:2.0:bindings:HTTP-POST' however no endpoint, with that URL and using a supported
binding,  can be found in the relying party's metadata 

But my metadata said

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Location="https://right-host/Shibboleth.sso/SAML2/POST" index="1"/>

As you can see, shibd asked to be redirected to the wrong place. The problem is that shibd uses the host name from Apache. (I assume you're using Apache. The setup is probably similar if not.)

The solution is to go to /etc/apache2/sites-enabled/default-ssl.conf and set ServerName to the correct host:port that matches your metadata. Then, open /etc/apache2/apache2.conf and make sure UseCanonicalName is On .

This is detailed in the docs , which I recommend reading carefully.