HTTPS SP and HTTP IDP

[Peter Schober]

* jerome lebegue <jerome.lebegue at gmail.com> [2013-03-28 11:40]:
> The issue I run into is that, as soon as I point to the link
> https://sp.example.com I am redirected to https://idp.internal.com and
> not the http://idp.internal.com I am expecting ...
> 
> Does SP and IDP access schemes have to be the same ?

No. The SP has any locations for SAML protocol messages at the IdP
configured. If the SP is Shibboleth (you didn't say) it's taken from
the IdP's metadata (which would mean the metadata is wrong).
Note that HTTP user agents might still have an SSO session with the
IDP (e.g. if the IDP is Shibboleth, which you didn't mention either,
and you're using the PreviousSession handler), so protecting this
would require TLS/SSL.

Personally I'd just slap a cert on the IDP and be done with it.
-peter