[ Spring saml, second local SP - entity alias and context provider ]

I have system with two loadbalancer exposing application for separate networks.

In application spring-saml extension is used for authentication with IdP (one visible from both networks). For first location all working as expected - default SP with entityId=exampleSP1.

When I configure second SP metadata (local with different entityId=exampleSP2) and call it using /saml/login/alias/exampleSP2 Application receive successful response from IdP but during SAMLCredential validation exception is thrown: "SAML message intended destination endpoint did not match recipient endpoint"

When using second SP destination endpoint is different from configured in contextProviderLB and exception occur.

Is a way to define separated contextProviderLB depends on which SP is used (or initial URL) ?

Answer 1

You're hitting an issue in https://jira.spring.io/browse/SES-150 which is now fixed in trunk. Please update your Spring SAML. And thank you leaving your comment in Jira.