title: Spring-SAML : Incoming SAML message is invalid
body: <p>I am facing an issue while integrating my app with SAML.</p>
  
  <p>The following is my error:</p>
  
  <pre><code>org.springframework.security.saml.SAMLProcessingFilter.attemptAuthentication: Incoming SAML message is invalid 
  org.opensaml.common.SAMLException: Endpoint with message binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST and URL https://myappruldotom/saml/SSO wasn't found in local metadata at org.springframework.security.saml.util.SAMLUtil.getEndpoint(SAMLUtil.java:357) ~[spring-security-saml2-core-1.0.2.RELEASE.jar:1.0.2.RELEASE]
  </code></pre>
  
  <p>My app is deployed on AWS and when i added the log statement in by writing the custom SAMLProcessingFilter and wrote implementation of getEndpoint() to add multiple log statements and copied the exact content of getEndpoint() method.</p>
  
  <p>The log statement shows that the endpoint is coming as IP address :
  MySAMLProcessingFilter.getEndpoint: MySAMLLOG - endpoint.getLocation() = <a href="https://10.193.160.123:443/mysamlapp/saml/SSO" rel="noreferrer">https://10.193.160.123:443/mysamlapp/saml/SSO</a></p>
  
  <p>I have defined entityId in my SAML config, but this also didn't help. entityId in my config file as  :</p>
  
  <pre><code>&lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
              &lt;property name="entityId" value="https://myappruldotom/mysamlapp/saml/metadata"/&gt;
              &lt;property name="requestSigned" value="false"/&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>securityContext.xml file :</p>
  
  <pre><code>&lt;beans
      xmlns="http://www.springframework.org/schema/beans"
      xmlns:security="http://www.springframework.org/schema/security"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:context="http://www.springframework.org/schema/context" 
      xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
  &lt;!-- ############################ Security Settings ############################ --&gt;
  
  
  &lt;!-- Enable auto-wiring --&gt;
  &lt;context:annotation-config/&gt;
  
  &lt;!-- Scan for auto-wiring classes in spring saml packages --&gt;
  &lt;context:component-scan base-package="org.springframework.security.saml"/&gt;
  
  &lt;!-- IMPORTANT!! This entry is required to enable method-level security. --&gt;
  &lt;security:global-method-security pre-post-annotations="enabled"&gt;&lt;/security:global-method-security&gt;
  
  &lt;!-- No security on resource files --&gt;
  &lt;security:http security="none" pattern="/resources/**" /&gt;
  
  &lt;!-- Secured pages with SAML as entry point with SPRING CSRF filter --&gt;
  &lt;security:http entry-point-ref="samlEntryPoint" disable-url-rewriting="true" use-expressions="true"&gt;
      &lt;security:csrf disabled="true"/&gt;
      &lt;security:intercept-url pattern="/cart/**" access="isAuthenticated()"/&gt;
      &lt;security:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
      &lt;security:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/&gt;
  &lt;/security:http&gt;
  
  
  &lt;!-- Filters for processing of SAML messages --&gt;
  &lt;bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy"&gt;
      &lt;security:filter-chain-map request-matcher="ant"&gt;
          &lt;security:filter-chain pattern="/saml/metadata/**" filters="metadataGeneratorFilter"/&gt;
          &lt;security:filter-chain pattern="/login/**" filters="samlEntryPoint"/&gt;
          &lt;security:filter-chain pattern="/saml/logout/**" filters="samlLogoutFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/&gt;
          &lt;security:filter-chain pattern="/saml/discovery/**" filters="samlIDPDiscovery"/&gt;
          &lt;security:filter-chain pattern="/saml/SingleLogout/**" filters="samlLogoutProcessingFilter"/&gt;
      &lt;/security:filter-chain-map&gt;
  &lt;/bean&gt;
  
  &lt;bean id="successRedirectHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/cart"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- After logout, show the logout success page --&gt;
  &lt;bean id="successLogoutHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler"&gt;
      &lt;property name="defaultTargetUrl" value="/"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Logout handler terminating local session --&gt;
  &lt;bean id="logoutHandler" class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"&gt;
      &lt;property name="invalidateHttpSession" value="true"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Handler deciding where to redirect user after failed login --&gt;
  &lt;bean id="failureRedirectHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"&gt;
      &lt;property name="useForward" value="true"/&gt;
  &lt;/bean&gt;
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
      &lt;!-- Register authentication manager for SAML provider --&gt;
      &lt;security:authentication-provider ref="samlAuthenticationProvider"/&gt;
  &lt;/security:authentication-manager&gt; 
  
  &lt;!-- Central storage of cryptographic keys --&gt;
  
  &lt;bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager"&gt;
      &lt;constructor-arg value="classpath:samlKeystore.jks"/&gt;
      &lt;constructor-arg type="java.lang.String" value="nalle123"/&gt;
      &lt;constructor-arg&gt;
          &lt;map&gt;
              &lt;entry key="apollo" value="nalle123"/&gt;
          &lt;/map&gt;
      &lt;/constructor-arg&gt;
      &lt;constructor-arg type="java.lang.String" value="apollo"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Logger for SAML messages and events --&gt;
  &lt;bean id="samlLogger" class="org.springframework.security.saml.log.SAMLDefaultLogger"/&gt;
  
  &lt;!-- IDP Discovery Service --&gt;
  &lt;bean id="samlIDPDiscovery" class="org.springframework.security.saml.SAMLDiscovery"&gt;&lt;/bean&gt;
  
  
  &lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
    &lt;constructor-arg&gt;
       &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
          &lt;property name="entityId" value="https://myappdotcom/mysamlapp/saml/metadata"/&gt;
          &lt;property name="requestSigned" value="false"/&gt;
      &lt;/bean&gt;
  &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;!-- Entry point to initialize authentication, default values taken from properties file --&gt;
  &lt;bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint"&gt;
     &lt;property name="filterProcessesUrl" value="/saml/SSO"/&gt;
     &lt;property name="defaultProfileOptions"&gt;
      &lt;bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"&gt;
          &lt;property name="includeScoping" value="false"/&gt;
      &lt;/bean&gt;
  &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="metadata" class="org.springframework.security.saml.metadata.CachingMetadataManager"&gt;
     &lt;property name="defaultIDP" value="https://dev-942345.oktapreview.com/"/&gt;
  
     &lt;constructor-arg&gt;
      &lt;list&gt;
          &lt;bean class="org.opensaml.saml2.metadata.provider.FilesystemMetadataProvider"&gt;
              &lt;constructor-arg&gt;
                  &lt;value type="java.io.File"&gt;#{systemProperties['catalina.home']}/saml/idp.xml&lt;/value&gt;
              &lt;/constructor-arg&gt;
              &lt;property name="parserPool" ref="parserPool"/&gt;
          &lt;/bean&gt;                
      &lt;/list&gt;
  &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  
  &lt;!-- SAML Authentication Provider responsible for validating of received SAML messages --&gt;
  &lt;bean id="samlAuthenticationProvider" class="org.springframework.security.saml.SAMLAuthenticationProvider"&gt;
     &lt;property name="userDetails" ref="samlUserDetailsService" /&gt;
     &lt;property name="forcePrincipalAsString" value="false" /&gt;
  &lt;/bean&gt;
  
  
  &lt;!-- Custom user details service to attach app specific roles to federated identities --&gt;
  &lt;bean id="samlUserDetailsService" class="com.zap.shop.SAMLUserDetailsServiceImpl"&gt;&lt;/bean&gt;
  
  &lt;!-- Provider of default SAML Context --&gt;
  &lt;bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderImpl"/&gt;
  
  &lt;!-- Processing filter for WebSSO profile messages --&gt;
  &lt;bean id="samlWebSSOProcessingFilter" class="org.springframework.security.saml.SAMLProcessingFilter"&gt;
      &lt;property name="authenticationManager" ref="authenticationManager"/&gt;
      &lt;property name="authenticationSuccessHandler" ref="successRedirectHandler"/&gt;
      &lt;property name="authenticationFailureHandler" ref="failureRedirectHandler"/&gt;
  &lt;/bean&gt;
  
  
  &lt;!-- Override default logout processing filter with the one processing SAML messages --&gt;
  &lt;bean id="samlLogoutFilter" class="org.springframework.security.saml.SAMLLogoutFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
      &lt;constructor-arg index="2" ref="logoutHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Filter processing incoming logout messages --&gt;
  &lt;!-- First argument determines URL user will be redirected to after successful global logout --&gt;
  &lt;bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.SAMLLogoutProcessingFilter"&gt;
      &lt;constructor-arg index="0" ref="successLogoutHandler"/&gt;
      &lt;constructor-arg index="1" ref="logoutHandler"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Class loading incoming SAML messages from httpRequest stream --&gt;
  &lt;bean id="processor" class="org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
      &lt;constructor-arg&gt;
          &lt;list&gt;
              &lt;ref bean="redirectBinding"/&gt;
              &lt;ref bean="postBinding"/&gt;
              &lt;ref bean="artifactBinding"/&gt;
              &lt;ref bean="soapBinding"/&gt;
              &lt;ref bean="paosBinding"/&gt;
          &lt;/list&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;!-- SAML 2.0 WebSSO Assertion Consumer --&gt;
  &lt;bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/&gt;
  
  &lt;!-- SAML 2.0 Holder-of-Key WebSSO Assertion Consumer --&gt;
  &lt;bean id="hokWebSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  
  &lt;!-- SAML 2.0 Web SSO profile --&gt;
  &lt;bean id="webSSOprofile" class="org.springframework.security.saml.websso.WebSSOProfileImpl"/&gt;
  
  &lt;!-- SAML 2.0 Holder-of-Key Web SSO profile --&gt;
  &lt;bean id="hokWebSSOProfile" class="org.springframework.security.saml.websso.WebSSOProfileConsumerHoKImpl"/&gt;
  
  &lt;!-- SAML 2.0 ECP profile --&gt;
  &lt;bean id="ecpprofile" class="org.springframework.security.saml.websso.WebSSOProfileECPImpl"/&gt;
  
  &lt;!-- SAML 2.0 Logout Profile --&gt;
  &lt;bean id="logoutprofile" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl"/&gt;
  
  &lt;!-- Bindings, encoders and decoders used for creating and parsing messages --&gt;
  &lt;bean id="postBinding" class="org.springframework.security.saml.processor.HTTPPostBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="redirectBinding" class="org.springframework.security.saml.processor.HTTPRedirectDeflateBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="artifactBinding" class="org.springframework.security.saml.processor.HTTPArtifactBinding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
      &lt;constructor-arg ref="velocityEngine"/&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.saml.websso.ArtifactResolutionProfileImpl"&gt;
              &lt;constructor-arg&gt;
                  &lt;bean class="org.apache.commons.httpclient.HttpClient"&gt;
                      &lt;constructor-arg&gt;
                          &lt;bean class="org.apache.commons.httpclient.MultiThreadedHttpConnectionManager"/&gt;
                      &lt;/constructor-arg&gt;
                  &lt;/bean&gt;
              &lt;/constructor-arg&gt;
              &lt;property name="processor"&gt;
                  &lt;bean class="org.springframework.security.saml.processor.SAMLProcessorImpl"&gt;
                      &lt;constructor-arg ref="soapBinding"/&gt;
                  &lt;/bean&gt;
              &lt;/property&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  
  &lt;bean id="soapBinding" class="org.springframework.security.saml.processor.HTTPSOAP11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="paosBinding" class="org.springframework.security.saml.processor.HTTPPAOS11Binding"&gt;
      &lt;constructor-arg ref="parserPool"/&gt;
  &lt;/bean&gt;
  
  &lt;!-- Initialization of OpenSAML library--&gt;
  &lt;bean class="org.springframework.security.saml.SAMLBootstrap"/&gt;
  
  &lt;!-- Initialization of the velocity engine --&gt;
  &lt;bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/&gt;
  
  &lt;!-- XML parser pool needed for OpenSAML parsing --&gt;
  &lt;bean id="parserPool" class="org.opensaml.xml.parse.StaticBasicParserPool" init-method="initialize"&gt;
      &lt;property name="builderFeatures"&gt;
          &lt;map&gt;
              &lt;entry key="http://xml.org/sax/features/external-general-entities" value="false"/&gt;
              &lt;entry key="http://javax.xml.XMLConstants/feature/secure-processing" value="true"/&gt;
              &lt;entry key="http://apache.org/xml/features/disallow-doctype-decl" value="true"/&gt;
          &lt;/map&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="parserPoolHolder" class="org.springframework.security.saml.parser.ParserPoolHolder"/&gt; 
  &lt;/beans&gt;
  </code></pre>
  
  <p>Thanks for your help in advance.</p>