Problems with IdP proxy

[Peter Schober]

* Yaowen Tu <yaowen.tu at gmail.com> [2013-09-18 07:11]:
>     SAML message intended destination endpoint
>     'http://sma-pc1:8080/idp/profile/SAML2/POST/SSO' did not match
>     the recipient endpoint
>     'http://sma-pc1:8900/idp/profile/SAML2/POST/SSO'

IMO this means you haven't virtualized all URLs correctly, i.e., the IdP
must be configured with the schema, hostname and port which is seen
externally, from your HTTP user agent.  The physical port etc. should
be irrelevant in any Shib/SAML related setting, incl metadata.
For Tomcat you'll probably need to set proxyPort (and scheme, if
you're terminating TLS/SSL on the proxy) on the relevant Connector.
-peter