HTTPS SP and HTTP IDP

[jerome lebegue]

Thanks for your reply,

Both SP and IDP are Shibboleth.

The IDP metadata contains 0 reference to HTTPS

----
root at idp /opt/shibboleth-idp/metadata> grep -i https idp-metadata.xml
root at idp /opt/shibboleth-idp/metadata>
-----

(The exact same file is shared with both SP, the HTTP one and the HTTPS one).

The IdP was configured and choices were made before I landed on the project.
Seems they got issues with HTTPS because the server was behind a SSL offloader.
The IdP sees HTTP request but is meant to be accessed via HTTPS and
just blow an error (may be simple to correct, I did not dig into
this).


On Thu, Mar 28, 2013 at 11:48 AM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * jerome lebegue <jerome.lebegue at gmail.com> [2013-03-28 11:40]:
>> The issue I run into is that, as soon as I point to the link
>> https://sp.example.com I am redirected to https://idp.internal.com and
>> not the http://idp.internal.com I am expecting ...
>>
>> Does SP and IDP access schemes have to be the same ?
>
> No. The SP has any locations for SAML protocol messages at the IdP
> configured. If the SP is Shibboleth (you didn't say) it's taken from
> the IdP's metadata (which would mean the metadata is wrong).
> Note that HTTP user agents might still have an SSO session with the
> IDP (e.g. if the IDP is Shibboleth, which you didn't mention either,
> and you're using the PreviousSession handler), so protecting this
> would require TLS/SSL.
>
> Personally I'd just slap a cert on the IDP and be done with it.
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net