Shibboleth SP ACSs over https behind a firewall

[Dominic O'Connor]

Hi,

We have a Shibboleth Service Provider (2.4.3) set up on Windows webservers
behind a firewall. The firewall offloads the SSL work and sends traffic to
our webservers over http.
Our metadata includes only https ACSs. However, when a user tries to
authenticate, the authnrequest is passing http endpoints. Consequently, the
IdP is getting the "no endpoint, with that URL and using a supported
binding,  can be found in the relying party's metadata" error. My guess is
that's happening because by the time the traffic is hitting our SP,
Shibboleth sees it as unencrypted (because it is), and so it generates
requests based on that. Is that a fair assumption? If so, is there a way
that I can tell Shibboleth to only generate requests with https endpoints?
I can't use handlerSSL="false" because the firewall is sending the requests
over http.

Thanks in advance,

Dominic
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121018/939605d2/attachment.html