title: How does a SAML Service Provider match an IDP metadata information?
body: <p>I'm using <a href="http://www.testshib.org/" rel="nofollow">TestShib</a> and <a href="https://github.com/omab/python-social-auth/blob/master/docs/backends/saml.rst" rel="nofollow">Python Social Auth SAML backend</a> to implement a Service Provider on a Django app.</p>
  
  <p>I've been able to configure my app, and build a metadata file.</p>
  
  <p>TestShib allows for my metadata file to be uploaded <a href="https://www.testshib.org/register.html" rel="nofollow">here</a>.</p>
  
  <p>I have configured TestShib's metadata correctly on my end and built up a test button pointing to TestShib's endpoint.</p>
  
  <p>When I click that button, I get redirected to TestShib, then provide test credentials, and then I get an error because the metadata does not match the redirect.</p>
  
  <p>How does TestShib, or any other IDP for that matter, manage to find the right metadata (among several SPs) after an incoming auth request? Does the EntityID have to match the URL of the Service Provider? </p>
  
  <p><strong>EDIT: (added more info)</strong></p>
  
  <p><em>SP's metadata (uploaded previously to TestShib):</em></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" cacheDuration="P10D" entityID="https://www.example.com"&gt;
      &lt;md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
          &lt;md:KeyDescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" use="signing"&gt;
              &lt;ds:KeyInfo&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509Certificate&gt;MIIDBDC .. QltX1icsr0=&lt;/ds:X509Certificate&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/ds:KeyInfo&gt;
          &lt;/md:KeyDescriptor&gt;
          &lt;md:KeyDescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" use="encryption"&gt;
              &lt;ds:KeyInfo&gt;
                  &lt;ds:X509Data&gt;
                      &lt;ds:X509Certificate&gt;MIIDBDC .. QltX1icsr0=&lt;/ds:X509Certificate&gt;
                  &lt;/ds:X509Data&gt;
              &lt;/ds:KeyInfo&gt;
          &lt;/md:KeyDescriptor&gt;
          &lt;md:NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified&lt;/md:NameIDFormat&gt;
          &lt;md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://staging.example.com/complete/xx-saml/" index="1" /&gt;
      &lt;/md:SPSSODescriptor&gt;
      &lt;md:Organization&gt;
          &lt;md:OrganizationName xml:lang="en-US"&gt;example&lt;/md:OrganizationName&gt;
          &lt;md:OrganizationDisplayName xml:lang="en-US"&gt;Example&lt;/md:OrganizationDisplayName&gt;
          &lt;md:OrganizationURL xml:lang="en-US"&gt;https://www.example.com&lt;/md:OrganizationURL&gt;
      &lt;/md:Organization&gt;
      &lt;md:ContactPerson contactType="technical"&gt;
          &lt;md:GivenName&gt;John Doe&lt;/md:GivenName&gt;
          &lt;md:EmailAddress&gt;johndoe@example.com&lt;/md:EmailAddress&gt;
      &lt;/md:ContactPerson&gt;
      &lt;md:ContactPerson contactType="support"&gt;
          &lt;md:GivenName&gt;John Doe&lt;/md:GivenName&gt;
          &lt;md:EmailAddress&gt;johndoe@example.com&lt;/md:EmailAddress&gt;
      &lt;/md:ContactPerson&gt;
  &lt;/md:EntityDescriptor&gt;
  </code></pre>
  
  <p><em>Request:</em></p>
  
  <p><a href="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fVNN" rel="nofollow">https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fVNN</a>  ...</p>
  
  <pre><code>&lt;samlp:AuthnRequest
      AssertionConsumerServiceURL="https://staging.example.com/complete/saml/"
      Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
      ID="ONELOGIN_973a7f348c282cc6dedd4410f900efcf9538dcda" IssueInstant="2016-08-22T14:12:11Z"
      ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ProviderName="Example"
      Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
      xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;saml:Issuer&gt;https://www.example.com&lt;/saml:Issuer&gt;
      &lt;samlp:NameIDPolicy AllowCreate="true"
          Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/&gt;
      &lt;samlp:RequestedAuthnContext Comparison="exact"&gt;
          &lt;saml:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/saml:AuthnContextClassRef&gt;
      &lt;/samlp:RequestedAuthnContext&gt;
  &lt;/samlp:AuthnRequest&gt;
  </code></pre>
  
  <p><em>Error:</em></p>
  
  <pre><code>    10:10:39.009 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party 'https://www.example.com' requested the response to be returned to endpoint with ACS URL 'https://staging.example.com/complete/saml/'  and binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, with that URL and using a supported binding,  can be found in the relying party's metadata 
      10:10:39.009 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447]
      - No return endpoint available for relying party https://www.example.com
  </code></pre>
  
  <p><a href="https://staging.example.com/complete/saml/" rel="nofollow">https://staging.example.com/complete/saml/</a> is available so the problem seems to be that the metadata info was not found by TestShib. Entity ID and Issuer seem to match .. </p>