Strategy Web ASP is configured to use SAML authentication with Shibboleth Service Provider . When accessing Main.aspx/Admin.aspx, the user is redirected to an IDP login page and must enter their credentials. When returning to Shibboleth at http://FQDN/Shibboleth.sso/SAML2/POST, a 500 error is received.
In the shibd_warn.log (default location: C:\opt\shibboleth-sp\var\log\shibboleth), the following entries appear:
2019-05-17 11:02:02 WARN Shibboleth.SSO.SAML2 [5] [default]: error processing incoming assertion:
SAML message delivered with POST to incorrect server URL.
2019-05-17 11:02:47 ERROR OpenSAML.MessageDecoder.SAML2POST [5] [default]: POST targeted at
(http://fqdn/Shibboleth.sso/SAML2/POST), but delivered to
(http://FQDN/Shibboleth.sso/SAML2/POST)
2019-05-17 11:02:47 WARN Shibboleth.SSO.SAML2 [5] [default]: error processing incoming assertion:
SAML message delivered with POST to incorrect server URL.
One of the reasons for this error is that the ACS URL on the IDP side is configured to http://fqdn/Shibboleth.sso/SAML2/POST (lowercase), however the site name in shibboleth2.xml is configured to http://FQDN/Shibboleth.sso/SAML2/POST (uppercase).
For example:
<Site id="1" name="http://FQDN/Shibboleth.sso/SAML2/POST"scheme="http" />
To resolve this issue, follow best practices and keep your use of FQDN consistent (uppercase or lowercase) in all SAML configurations, including all entries in shibboleth2.xml (Site name, Host name, etc.), and all entries on the IDP side (ACS URL, SP Entity ID).
Restart Shibboleth Daemon and World Wide Web Publishing Service from Windows Services after modifying the shibboleth2.xml.
