opensaml endpoint check

[Paul Hethmon]

Ok, following up on my own post here. This actually was not as much trouble as I thought. I just had my class extend HttpPostDecoder and then implemented "compareEndpointURIs" to return true. It would be nice to not have to do this, but that's not a problem of OpenSAML, that's just my environment.

thanks,

Paul

From: Paul Hethmon <paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>>
Reply-To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Date: Tuesday, May 1, 2012 4:16 PM
To: Shibboleth Dev <dev at shibboleth.net<mailto:dev at shibboleth.net>>
Subject: opensaml endpoint check

I'm integrating SAML2 support into a Java based product as a relying party. It has its own http engine so I'm a bit limited in how I implement that support. Another condition is that the IdP is MS ADFS (always fun). So I've had to use Apache with mod_proxy to provide SSL so that ADFS is happy. That's where my problem has come in. When the OpenSAML libraries validate the response, it fails with the:

SAML message intended destination endpoint did not match recipient endpoint

I can see the cause and understand why its there, but have to figure out a work around. Near as I can tell, I can't get around the mismatch on the scheme when it goes through the proxy. So I end up with these two URLs:

https://app.hethmon.net/foo/bar
http://app.hethmon.net/foo/bar

So if I can't configure my way out of it (and I've been looking for that option), is the only option in OpenSAML to override the  endpoint check in the handler? I just hate doing that as I have to branch the code.

thanks,

Paul

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120501/37f31b92/attachment-0001.html