HTTPS SP and HTTP IDP

[Peter Schober]

* jerome lebegue <jerome.lebegue at gmail.com> [2013-03-28 12:04]:
> Both SP and IDP are Shibboleth.

OK

> The IDP metadata contains 0 reference to HTTPS
[...]
> (The exact same file is shared with both SP, the HTTP one and the HTTPS one).

I don't understand what this means. If you don't what the SP to see
HTTPS endpoints at the IdP, well, don't give it metadata with HTTPS in
it.
(If the above means you're loading several differing copies of metadata
for the same entityID in the SP: Don't do that. It doesn't make any
sense and AFAIK the project does not guarantee a specific order or
prevalence of multiple (differing) copies for the same entity. For the
IDP in the current implementation the first copy of anything wins, no
idea for the SP. And could change anytime, so shouldn't be relied on.)

> The IdP was configured and choices were made before I landed on the project.
> Seems they got issues with HTTPS because the server was behind a SSL offloader.
> The IdP sees HTTP request but is meant to be accessed via HTTPS and
> just blow an error (may be simple to correct, I did not dig into
> this).

That's not an issue with the Shibboeth software but of the
container/webserver it runs in (so depends on deployment choices,
which you didn't mention) but yes, that's usually simple to correct.

Not running the IDP TLS/SSL-protected because someone couldn't get the
URL scheme properly virtualized is an "interesting" approach.
-peter