where is HTTPS/HTTP set for the relying party endpoint return?

[Cantor, Scott E.]

On 8/5/11 2:20 PM, "Peterson, Tommy" <Tommy.Peterson at xpandcorp.com> wrote:

>So are you saying if the request comes from HTTP it will send it back to
>HTTP. If the request of the IDP comes from HTTPS it will expect to a
>return to HTTPS?

Same question you asked two weeks ago, same answer.

The SP generates a self-referential URL back to itself by doing exactly
what Apache tells it to do. If the resource is http, then the redirect
back will in general be http. If it's https, it will be https.

If the site is dual-schemed and runs both, you can force the SAML response
locations to https using the handlerSSL setting. That is the only setting
in general that overrides the standard Apache behavior.

-- Scott