0

I am having the same problem configuring spring-security-saml2-core that is presented in this POST. In my case, I have deployed my application in a Weblogic cluster with several managed nodes.

When the authentication flow starts, the user is correctly authorized but on my server (SP) it shows the error: "SAML message intended destination endpoint ..." saying that the request has been made from "https://nodename/" instead of the DNS I want the response from.

As suggested in the post I quoted at the beginning, I have verified that the reply address in Azure is correct.

Also, I have reviewed these posts and I have applied all the solutions they propose, but I still have the problem, I have not found a solution:

  • SAML Exception Intended destination endpoint did not match: I don't know where to configure the destination endpoint in Spring (because I understand that I don't have that it is not the destination property of the discovery).

  • Recipient endpoint doesn't match with SAML response: I have configured both SAMLContextProviderLB and MetadataGenerator#setBaseUrl() with the DNS the response has to be returned to.

      @Bean
      public MetadataGenerator metadataGenerator() {
          MetadataGenerator metadataGenerator = new MetadataGenerator();
          metadataGenerator.setEntityId(serviceProviderEntityId);
          metadataGenerator.setEntityBaseURL("https://my.dns:8993/app");
          metadataGenerator.setExtendedMetadata(extendedMetadata());
          metadataGenerator.setIncludeDiscoveryExtension(false);
          metadataGenerator.setKeyManager(keyManager());
          return metadataGenerator;
      }
    
      @Bean
      public ExtendedMetadata extendedMetadata() {
          ExtendedMetadata extendedMetadata = new ExtendedMetadata();
          extendedMetadata.setSigningAlgorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256");
          extendedMetadata.setSignMetadata(true);
          extendedMetadata.setEcpEnabled(true);
          extendedMetadata.setIdpDiscoveryEnabled(false);
          return extendedMetadata;
      }
      @Bean
      public SAMLContextProviderLB contextProvider() {
          SAMLContextProviderLB samlContextProviderLB = new SAMLContextProviderLB();
          samlContextProviderLB.setScheme("https");
          samlContextProviderLB.setServerPort(8993);
          samlContextProviderLB.setServerName("my.dns");
          samlContextProviderLB.setIncludeServerPortInRequestURL(true);
          samlContextProviderLB.setContextPath("/app");
          log.info("SAMLContextProviderLB ==> {}", samlContextProviderLB);
          return samlContextProviderLB;
      }
    

I honestly don't know what else to do. Do I have to do any special configuration in Weblogic? Am I leaving something unconfigured in Azure?

Thanks in advance

Jose A. Matarán
  • 1,044
  • 3
  • 13
  • 33

0 Answers0