What determines protocol of SAML2/POST assertion?

[Cantor, Scott]

On 3/4/15, 7:09 PM, "Spencer Gaddy" <recneps at gmail.com> wrote:



>Hi, I am working on a Shibboleth native 2.0 SP setup and having a bit of 
>trouble after setting up all my load balancers and url rewrite rules.

Because you haven't actually done that step fully.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPNoSSL

>Essentially we are getting assertions back to our SP endpoint over http, 
>but we do not accept http on our front end load balancer.

No, that's not the case. You're getting them over http physically and your 
web server does not know that it's been virtualized and should be treating 
them as https.

>The odd thing about this is that we have specifically set the endpoint as 
>https in our metadata file. As per below.

Metadata does not control how web servers interpret their requests and 
report URLs.

-- Scott