Problems with IdP proxy

[Yaowen Tu]

Peter,

Thanks for you reply. To be honest I am not very clear what I need to do in
order to resolve the issue I am seeing. Could you please elaborate a little
bit more?

Maybe I need to switch direct to focus on letting Tomcat knows that there
is a proxy in front of it, so that request.getServerName() will return the
proxy server name/port. In that case there would be no problem in matching
the endpoint. Is that what you mean to set proxyPort for Tomcat?

Thanks,
Yaowen


Yaowen


On Wed, Sep 18, 2013 at 12:48 AM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Yaowen Tu <yaowen.tu at gmail.com> [2013-09-18 07:11]:
> >     SAML message intended destination endpoint
> >     'http://sma-pc1:8080/idp/profile/SAML2/POST/SSO' did not match
> >     the recipient endpoint
> >     'http://sma-pc1:8900/idp/profile/SAML2/POST/SSO'
>
> IMO this means you haven't virtualized all URLs correctly, i.e., the IdP
> must be configured with the schema, hostname and port which is seen
> externally, from your HTTP user agent.  The physical port etc. should
> be irrelevant in any Shib/SAML related setting, incl metadata.
> For Tomcat you'll probably need to set proxyPort (and scheme, if
> you're terminating TLS/SSL on the proxy) on the relevant Connector.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130918/f22cbaad/attachment.html