title: Cannot deploy Spring Security SAML sample application correctly
body: <p>I'm trying to deploy the sample application that's part of the Spring Security SAML extension, using SSOCircle as the IDP, but I've run into a number of problems. I'd really appreciate some help fixing this.</p>
  
  <p>Here's what I've done.</p>
  
  <p>I downloaded the source from: <a href="https://github.com/spring-projects/spring-security-saml/tree/1.0.0.RELEASE" rel="nofollow noreferrer">https://github.com/spring-projects/spring-security-saml/tree/1.0.0.RELEASE</a> and built the sample application via : <code>mvn package</code>. I then deployed the WAR file to a standalone instance of Tomcat (v7.0.41).</p>
  
  <p>I launched the app: <a href="http://server:8550/spring-security-saml2-sample" rel="nofollow noreferrer">http://server:8550/spring-security-saml2-sample</a>,
  clicked on <strong>Metadata Administration</strong>, and clicked on the <strong>Login</strong> button, but I kept being redirecting back to <a href="http://server:8550/spring-security-saml2-sample/saml/web/metadata/login" rel="nofollow noreferrer">http://server:8550/spring-security-saml2-sample/saml/web/metadata/login</a>.</p>
  
  <p>I bypassed login for Metadata Administration by changing the line:</p>
  
  <p><code>&lt;security:intercept-url pattern="/saml/web/**" access="ROLE_ADMIN"/&gt;
  </code></p>
  
  <p>in securityContext.xml to:</p>
  
  <p><code>&lt;security:intercept-url pattern="/saml/web/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
  </code></p>
  
  <p>Navigating back to <a href="http://server:8550/spring-security-saml2-sample/saml/web/metadata" rel="nofollow noreferrer">http://server:8550/spring-security-saml2-sample/saml/web/metadata</a>, I could now click on the <strong>Generate new service provider metadata</strong> button. I entered a value for <strong>Entity ID</strong>, accepted defaults for the remaining options, and clicked <strong>Generate metadata</strong>.
  I saved the SP metadata file to <code>/WEB-INF/classes/metadata/serverId_sp.xml</code> as instructed, and added the SP configuration data to <code>metadata</code> bean in <code>securityContext.xml</code>.
  I logged in to <a href="https://idp.ssocircle.com/sso" rel="nofollow noreferrer">https://idp.ssocircle.com/sso</a> and registered SP metadata.
  I then commented out both occurrences of the line:</p>
  
  <p><code>&lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
  </code></p>
  
  <p>in <code>securityContext.xml</code>, and restarted the application.</p>
  
  <p>On the main page I selected the <a href="http://idp.ssocircle.com" rel="nofollow noreferrer">http://idp.ssocircle.com</a> option, and clicked <strong>Start single sign-on</strong>. I was correctly redirected to SSOCircle; I entered my user name &amp; password, and was redirected back to the spring-security-saml2-sample application, but the following error was displayed:</p>
  
  <pre><code>org.springframework.security.authentication.AuthenticationServiceException: Error validating SAML message
  at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:95)
  at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
  at org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication(SAMLProcessingFilter.java:84)
  at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:195)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
  at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
  at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:166)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
  at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
  at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
  at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
  at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
  at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
  at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
  at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
  at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
  at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
  at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
  at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
  at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
  at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1023)
  at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
  at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:1852)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
  at java.lang.Thread.run(Thread.java:722)
  Caused by: org.opensaml.common.SAMLException: InResponseToField of the Response doesn't correspond to sent message a2ei6e3068d8fi72g4a0fcc1j41142
  at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:139)
  at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:82)
  ... 29 more
  </code></pre>
  
  <p>Regarding this specific problem, I don't think this answer (<a href="https://stackoverflow.com/questions/27778889/spring-saml-integration-with-wso2-identity-server-saml-message-id-not-reconised">Spring SAML integration with WSO2 Identity server, SAML Message ID not reconised</a>) is relevant, since I'm using SSOCircle as my IDP; i.e. the domains for my SP and the IDP are different.</p>
  
  <p>The <a href="http://docs.spring.io/spring-security-saml/docs/1.0.0.RELEASE/reference/html/chapter-troubleshooting.html" rel="nofollow noreferrer">section on troubleshooting</a> in the Spring SAML documentation gives a way to disable checking the <code>InResponseToField</code> setting by modifying the <code>contextProvider</code> bean in <code>securityContext.xml</code>.
  I implemented this fix, and restarted the test application once more.</p>
  
  <p>I can log in via SSOCircle as before, but now when I'm redirected back to spring-security-saml2-sample, I'm always redirected back to <a href="http://server:8550/spring-security-saml2-sample/saml/discovery?entityID=serverId&amp;returnIDParam=idp" rel="nofollow noreferrer">http://server:8550/spring-security-saml2-sample/saml/discovery?entityID=serverId&amp;returnIDParam=idp</a>; i.e. the details of the logged in user are not displayed (as in the online demo version at <a href="http://saml-federation.appspot.com/" rel="nofollow noreferrer">http://saml-federation.appspot.com/</a>), and I never see the <strong>Global Logout</strong> and <strong>Local Logout</strong> buttons. Even if I enter the URL <a href="http://server:8550/spring-security-saml2-sample" rel="nofollow noreferrer">http://server:8550/spring-security-saml2-sample</a> explicitly in my browser, I'm always redirected back to <a href="http://server:8550/spring-security-saml2-sample/saml/discovery?entityID=serverId&amp;returnIDParam=idp" rel="nofollow noreferrer">http://server:8550/spring-security-saml2-sample/saml/discovery?entityID=serverId&amp;returnIDParam=idp</a>.</p>
  
  <p>Since I'm deploying the sample application to a standalone instance of Tomcat, I also made the changes suggested in this answer: <a href="https://stackoverflow.com/questions/25212087/spring-security-saml-metadata-url-on-tomcat">Spring Security SAML Metadata URL on Tomcat</a>. However, the behaviour is still the same.</p>
  
  <p>So, this is where I'm stuck now. Any ideas what might be causing my problems? Why isn't my version of the sample application behaving the same way as the online demo version?</p>
  
  <p>Any help will be gratefully received - thank you.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>The HAR file of the network traffic is here: <a href="http://pastebin.com/EUPHA4gE" rel="nofollow noreferrer">http://pastebin.com/EUPHA4gE</a></p>
  
  <p>The debug output to stdout is quite long; I've split it into two parts:</p>
  
  <p>Part one: <a href="http://pastebin.com/TkZS7uZM" rel="nofollow noreferrer">http://pastebin.com/TkZS7uZM</a></p>
  
  <p>Part two: <a href="http://pastebin.com/mrRkLs2T" rel="nofollow noreferrer">http://pastebin.com/mrRkLs2T</a></p>
  
  <p>I've also posted the Tomcat access log if that's a help: <a href="http://pastebin.com/992btULh" rel="nofollow noreferrer">http://pastebin.com/992btULh</a></p>
  
  <p><strong>UPDATE 2</strong></p>
  
  <p>The HAR file of the updated network traffic is here: <a href="http://pastebin.com/EUPHA4gE" rel="nofollow noreferrer">http://pastebin.com/EUPHA4gE</a></p>
  
  <p>The <em>original</em> war file I deployed (before making any of the changes mentioned above) is here: <a href="https://dl.dropboxusercontent.com/u/18025575/spring-security-saml2-sample.war" rel="nofollow noreferrer">https://dl.dropboxusercontent.com/u/18025575/spring-security-saml2-sample.war</a></p>
  
  <p>A war file containing the configuration changes to various files, as described above, is here: <a href="https://dl.dropboxusercontent.com/u/18025575/spring-security-saml2-sample-with-changes.war" rel="nofollow noreferrer">https://dl.dropboxusercontent.com/u/18025575/spring-security-saml2-sample-with-changes.war</a></p>