Running mod_shib on a non-standard port (i.e. 9999 rather than 443)

[Cantor, Scott]

On 4/28/15, 7:01 PM, "Philip Durbin" <philip_durbin at harvard.edu> wrote:


>>
>> Your metadata is what it checks against, the URL is in the AuthnRequest.
>
>I assume you mean to put a "not" in there... "Your metadata is *not*
>what it checks against".

No, it *is* what it checks against. Your web server told the SP to request 
a response to 443 and the metadata contains 9999, and so it failed as an 
invalid request. It is possible to just say "send it to the default 
endpoint in the metadata" but the SP doesn't routinely operate that way.

>GET 
>https://shibtest.dataverse.org:9999/Shibboleth.sso/Login?SAMLDS=1&target=h
>ttps://shibtest.dataverse.org/shib.xhtml&entityID=https%3A%2F%2Fidp.testsh
>ib.org%2Fidp%2Fshibboleth

The target there is all you need to know, you're telling it to use a 
target on 443, and so that requires it to manufacture a response URL using 
443 instead of 9999.

>Ok, so I must not have configured Apache properly to listen on 9999
>rather than 443.

You may just have told the SP deliberately to build a URL that won't work 
because of the target parameter. I didn't know you were using a 
SessionInitiator/DS. That's a different use case with more variables.

-- Scott