Shibboleth does not accept absolute value in Sessions.handlerURL

[Cantor, Scott]

On 2/16/15, 6:41 PM, "nr673 ." <nara.rama.us at gmail.com> wrote:
>
>In my environment, the Apache server is configured to accept the SSL 
>connection only with the empty port or default port 443.

That isn't the sum total of your configuration, you're SSL offloading 
and/or virtualizing in some way, and that creates requirements for your 
Apache options like ServerName.

>So, I configured the post back URL in OKTA(IdP) as 
>https://server.name1/Shibboleth.sso/SAML2/POST 
><https://server.name1/Shibboleth.sso/SAML2/POST>. But, the shibboleth 
>generates the POST url with the default port number as
>https://server.name1:80/Shibboleth.sso/SAML2/POST. This url mismatch 
>results in the BindingException.

Which is because your web server is broken, per above. You're accessing it 
in a manner that makes it believe its port is 80 so that's what it 
generates. Your ServerName probably needs :443 in it.

>So, I want to modify the URL generated by Shibboleth. Since the 
>handlerURL accepts only the relative value, I cannot make the Shibboleth 
>to generate either
>https://server.name1/Shibboleth.sso/SAML2/POST or
>https://server.name1:443/Shibboleth.sso/SAML2/POST.  

It doesn't just accept a relative value, and in any case that is *not* the 
fix. Your web server configuration is wrong and needs to be properly 
virtualized so that the logical port and scheme are overriding the 
physical ones the server sees.

-- Scott