<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); ">
<div>Ok, following up on my own post here. This actually was not as much trouble as I thought. I just had my class extend HttpPostDecoder and then implemented "compareEndpointURIs" to return true. It would be nice to not have to do this, but that's not a problem
of OpenSAML, that's just my environment.</div>
<div><br>
</div>
<div>thanks,</div>
<div><br>
</div>
<div>Paul</div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; "><br>
</div>
<span id="OLK_SRC_BODY_SECTION" style="font-size: 14px; font-family: Calibri, sans-serif; ">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Paul Hethmon <<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, May 1, 2012 4:16 PM<br>
<span style="font-weight:bold">To: </span>Shibboleth Dev <<a href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>opensaml endpoint check<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>I'm integrating SAML2 support into a Java based product as a relying party. It has its own http engine so I'm a bit limited in how I implement that support. Another condition is that the IdP is MS ADFS (always fun). So I've had to use Apache with mod_proxy
to provide SSL so that ADFS is happy. That's where my problem has come in. When the OpenSAML libraries validate the response, it fails with the:</div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre">SAML message intended destination endpoint did not match recipient endpoint</span></div>
<div><br>
</div>
<div>I can see the cause and understand why its there, but have to figure out a work around. Near as I can tell, I can't get around the mismatch on the scheme when it goes through the proxy. So I end up with these two URLs:</div>
<div><br>
</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><a href="https://app.hethmon.net/foo/bar">https://app.hethmon.net/foo/bar</a></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><a href="http://app.hethmon.net/foo/bar">http://app.hethmon.net/foo/bar</a></div>
<div><br>
</div>
<div>So if I can't configure my way out of it (and I've been looking for that option), is the only option in OpenSAML to override the endpoint check in the handler? I just hate doing that as I have to branch the code.</div>
<div><br>
</div>
<div>thanks,</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
</div>
</div>
</span>
</body>
</html>