I am having the same problem configuring spring-security-saml2-core
that is presented in this POST. In my case, I have deployed my application in a Weblogic cluster with several managed nodes.
When the authentication flow starts, the user is correctly authorized but on my server (SP) it shows the error: "SAML message intended destination endpoint ..." saying that the request has been made from "https://nodename/" instead of the DNS I want the response from.
As suggested in the post I quoted at the beginning, I have verified that the reply address in Azure is correct.
Also, I have reviewed these posts and I have applied all the solutions they propose, but I still have the problem, I have not found a solution:
SAML Exception Intended destination endpoint did not match: I don't know where to configure the destination endpoint in Spring (because I understand that I don't have that it is not the destination property of the discovery).
Recipient endpoint doesn't match with SAML response: I have configured both SAMLContextProviderLB and MetadataGenerator#setBaseUrl() with the DNS the response has to be returned to.
@Bean public MetadataGenerator metadataGenerator() { MetadataGenerator metadataGenerator = new MetadataGenerator(); metadataGenerator.setEntityId(serviceProviderEntityId); metadataGenerator.setEntityBaseURL("https://my.dns:8993/app"); metadataGenerator.setExtendedMetadata(extendedMetadata()); metadataGenerator.setIncludeDiscoveryExtension(false); metadataGenerator.setKeyManager(keyManager()); return metadataGenerator; } @Bean public ExtendedMetadata extendedMetadata() { ExtendedMetadata extendedMetadata = new ExtendedMetadata(); extendedMetadata.setSigningAlgorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"); extendedMetadata.setSignMetadata(true); extendedMetadata.setEcpEnabled(true); extendedMetadata.setIdpDiscoveryEnabled(false); return extendedMetadata; } @Bean public SAMLContextProviderLB contextProvider() { SAMLContextProviderLB samlContextProviderLB = new SAMLContextProviderLB(); samlContextProviderLB.setScheme("https"); samlContextProviderLB.setServerPort(8993); samlContextProviderLB.setServerName("my.dns"); samlContextProviderLB.setIncludeServerPortInRequestURL(true); samlContextProviderLB.setContextPath("/app"); log.info("SAMLContextProviderLB ==> {}", samlContextProviderLB); return samlContextProviderLB; }
I honestly don't know what else to do. Do I have to do any special configuration in Weblogic? Am I leaving something unconfigured in Azure?
Thanks in advance