What determines protocol of SAML2/POST assertion?

[Peter Schober]

* Spencer Gaddy <recneps at gmail.com> [2015-03-04 20:10]:
> To report this problem, please contact the site administrator at
> root at localhost. Please include the following message in any email:
> opensaml::BindingException at (http://${ourHost}.com/auth/shib/SAML2/POST)
> SAML message delivered with POST to incorrect server URL.
> 
> The odd thing about this is that we have specifically set the endpoint as
> https in our metadata file. As per below.
> 
> <md:AssertionConsumerService
> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> Location="https://${ourHost}/auth/shib/SAML2/POST"
> index="1"/>

Does the SP know anything about this location? It certainly doesn't
read its own metadata to find out what you want the software to do.

As to incorrect AssertionConsumerService URLs the IDP sends the
response to, does the SP specify it correctly in the authentication
request (assuming there is one)? If not you have a misconfigured
web server as that's where the SP get's self-referencing URLs for.
E.g. if you're virtualizing via TLS offloading the web server needs to
be configured with the publicly visible schema and hostname, not the
physical one. For Apache httpd setting  "ServerName
https://example.org:443" will do that for you.
-peter