BaseSAMLMessageDecoder.checkEndpointURI

[Peter Schober]

* Brent Putman <putmanb at georgetown.edu> [2012-03-01 19:13]:
> On 3/1/12 1:05 PM, Brent Putman wrote:
> > Perhaps you can explain more of the problem that you are trying to
> > solve.  The usual problem is that the message receipt endpoint is not
> > calculated correctly, when things like reverse proxy from Apache via
> > AJP are used.  In the decoder this URI is calculated simply as the
> > value of:  HttpServletRequest# getRequestURL().  So that has to be
> > right.  For Tomcat I believe that they have some attributes you can
> > set on the AJP connector to determine this. 
> 
> Btw, I don't think this is always necessary with Tomcat + Apache + AJP. 
> Just some cases, but I don't remember the specifics.

SSL-offloading from an httpd fronting Tomcat via AJP, for example.
ServerName won't be carried though correctly and you'd fix the scheme
("scheme") and port ("proxyPort") seperately in the AJP connector.
-peter