Shibboleth SP ACSs over https behind a firewall

[Kevin P. Foote]

Dominic, 

-> We have a Shibboleth Service Provider (2.4.3) set up on Windows webservers
-> behind a firewall. The firewall offloads the SSL work and sends traffic to
-> our webservers over http.
-> Our metadata includes only https ACSs. However, when a user tries to
-> authenticate, the authnrequest is passing http endpoints. Consequently, the
-> IdP is getting the "no endpoint, with that URL and using a supported


You have to ensure that the webserver is responding correctly. 

In your case this is not happening. Your webserver is responding as http
when it should be responding as https.. If you are accessing a https site
then the webserver needs to respond as such regardless of what hardware
is sitting in between the browser and the webserver. 

This topic has been covered on list numerous times and is also covered
in the wiki.

Search list for "load balanced SP" or "SP https offload" or some other 
variant of that nature.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted

Example: With apache this is done with the ServerName variable .. 


------
thanks
  kevin.foote