Not getting SP resource after authentication

[Peter Schober]

* Zico <mailzico at gmail.com> [2013-10-06 17:10]:
> > Did you look at the documentation?
> > Documentation Home -> Troubleshoot -> Looping.
> 
> Yes, I checked. But two things stopped me from wiki:
> 
> 1. I want my SP to work with HTTP ( not with HTTPS ). So, I won't
> block my non-SSL activity.
> 2. It is in IIS6 and wiki says: "Use native web server functionality
> to require SSL. This generally causes the server to return an error
> page to the browser indicating SSL is required. Note that this will
> not work on IIS, because the detection of this condition occurs after
> the filter installed by the SP runs".

Unrelated to this but an SP without SSL will create security warnings
in pretty much any popular web browser when using the most common
HTTP POST binding -- because the IDP will (hopefully) be running on
HTTPS and a HTTP POST from an HTTPS URL (at the IDP) to a plain-HTTP
one (at the SP) causes such a warning.
The /only/ way around this is using another binding (HTTP Artifact)
which is not widely suported and makes clustering the IDP a pain (if
that ever is desired). Just saying.

But the referenced wiki page has more info than "stop plain HTTP
traffic". Note epescially:

  "The underlying cause of any looping scenario is a mismatch between
  the properties of the session cookie created by an Assertion
  Consumer Service and the URL(s) of the resources the session is
  supposed to secure."

It also goes on to mention how to easily capture HTTP requests and
responses (e.g. using Mozilla's Live HTTP Headers or SAMLtracer
extensions). Did you try that? Did you closely watch out for the stuff
the page describes in the section "URLs to Capture"?

>From what you write I don't have the impression you read or acted on
any of the information on that page but jumped straight to "disable
HTTP" which is not an option in your case, as you say (as you seem to
prefer everyone assessing your SP getting security warnings; unless
you have the IDP running on plain HTTP, which would invite a whole
other set of unrelated comments).
-peter