Forum Discussion

rgordon_01's avatar
rgordon_01
Icon for Nimbostratus rankNimbostratus
Sep 11, 2018

Can SAML request issuer and SP connector entity id be different

Here's my problem. Our f5 is acting as idP. When I go to the SP initiated link it does not work. I get a page cannot be displayed. I can see in fiddler it's adding - ?binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST - to the end of the link which is why the page comes back cannot be displayed. That's 1 issue. However, the issue I'm concerned about, and want to know if it's even possible is - can the SAML request issuer and SP connector entity id be different? in my apm logs I have this error: No SP Connector attached to SAML SSO from assigned SAML resources matching authentication request. If ACS URL is present in authentication request it should match ACS URL from SP Connector. If Issuer is present in authentication request it should match entity_id from SP connector. The SP initiated link is https://staging.com for example but the entity id External SP connector link is https://training.com for example. I've never had an SP provider go to a different so I don't that this is possible.

 

I have a SAML resource attached, SP binded with idP, etc... so that is not the issue.

 

APM
security

1 Reply

Sort By
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Sep 11, 2018

    Hi,

    You have to check 2 things, so it's a good thing that you use Fiddler.

    Capture saml request using fiddler then decode the saml request using this link:

    https://www.samltool.com/decode.php

    Then checked the following point in your saml request (decode):

    • saml issuer

    It will be your SP entity ID that you set in your external SP

    • ACS: saml AssertionConsumerServiceURL

    AssertionConsumerServiceURL="It will be ACS URL that you set on your external SP"

    if that's not the case you have to change the settings of your external sp on F5, for addapter. Sometimes you retrieve metadata of an external app and app owner change them without provide you the new info...

    Hope it's clear. keep me update.

    regards