mismatch in ACS URL - port included in SP request to IdP

[Cantor, Scott]

On 10/31/12 12:14 PM, "Kohlhaas, James" <James.Kohlhaas at ellucian.com>
wrote:

>The request from the SP asks to be sent back to the Assertion Consumer
>Service endpoint at
>https://mysite:443/Shibboleth.sso/SAML2/POST for
>urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST .

When the SP does that, it means that the request is coming in over http,
but it sees the port as 443, which is non-default so has to be specified.

> 
>The SP is 2.5 and configured using IIS 7. I am using the standard 443
>port with HTTPS for mysite.

There's no virtualization going on? Client directly over TLS to port 443?

>  The only references to the port are in the ISAPI and RequestMapper
>sections of the shibboleth2 configuration:
><InProcesslogger="native.logger">
><ISAPInormalizeRequest="true"safeHeaderNames="true">
><Siteid="2"name="mysite"scheme="https"port="443"/>
></ISAPI>

That's a virtualization rule. You're overriding the physical scheme and
port there.

I need to check something in the code, but I think something's not set up
right here.

>The port is not defined in the entityID:

And entityID is a name, not a location. Has nothing to do with it.

>Is it possible to make a modification so that the endpoint requested for
>our response to be sent to does not include :443?

IIS doesn't actually support virtualization, so that alone means it's only
going to work to a point. This sounds like a bug, but I'm sure what it is
yet.

-- Scott