How to support an SP that accepts both http and https on IdP

[Peter Schober]

* Tom Scavo <trscavo at gmail.com> [2013-03-27 00:03]:
> On Tue, Mar 26, 2013 at 6:43 PM, Nate Klingenstein <ndk at internet2.edu> wrote:
> > Yes, exactly right.  You might also want to flag the https:// one with
> > isDefault="true".
> 
> Right, if your federation supports that ;-) Barring that, list the
> "default" endpoint first.

I don't think either of those two things will change anything as the
SP likely includes the endpoint in the authnRequest, so if the IdP has
that available in metadata at all the user agent will always end up
being sent to the http endpoint.
Which will always (assuming HTTP-POST binding and IDP on TLS/SSL)
create a security warning in the user agent. Very ugly (even if wrong,
as long as the assertion is encrypted no data will be exposed).

If the SP is using the Shibboleth SP software they could use the
redirectToSSL content setting of the SP
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings
to redirect right before active protection kicking in. Then TLS/SSL
would only be forced before logins (and for access after those).
-peter