opensaml endpoint check

[Paul Hethmon]

I'm integrating SAML2 support into a Java based product as a relying party. It has its own http engine so I'm a bit limited in how I implement that support. Another condition is that the IdP is MS ADFS (always fun). So I've had to use Apache with mod_proxy to provide SSL so that ADFS is happy. That's where my problem has come in. When the OpenSAML libraries validate the response, it fails with the:

SAML message intended destination endpoint did not match recipient endpoint

I can see the cause and understand why its there, but have to figure out a work around. Near as I can tell, I can't get around the mismatch on the scheme when it goes through the proxy. So I end up with these two URLs:

https://app.hethmon.net/foo/bar
http://app.hethmon.net/foo/bar

So if I can't configure my way out of it (and I've been looking for that option), is the only option in OpenSAML to override the  endpoint check in the handler? I just hate doing that as I have to branch the code.

thanks,

Paul

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120501/3e0eb6fd/attachment.html