Idp behind SSL endpoint without AJP

[Andrej Gregorka]

I have IDP deployed behind SSL endpoint. If I connect to IDP using AJP everything works fine:
ProxyPass           /idp/           ajp:// xxx.xxx.xxx.xxx:8009/idp/
ProxyPassReverse    /idp/           ajp:// xxx.xxx.xxx.xxx:8009/idp/


However, I will not be able to use AJP in production, so I have to connect from proxy using http. If I change to http:
          ProxyPass           /idp/           http://xxx.xxx.xxx.xxx.si:8080/idp/
         ProxyPassReverse    /idp/           http:// xxx.xxx.xxx.xxx:8080/idp/


I get the following error in idp-process.log:
10:09:40.817 - ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML message intended destination endpoint 'https://domain/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'http:// domain /idp/profile/SAML2/Redirect/SSO'
10:09:40.818 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements


In idp-access.log:
20150921T084714Z|10.10.10.161|domain:80|/profile/SAML2/Redirect/SSO|


How can I get the IDP working behind proxy using the http connection?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150921/55acc31f/attachment.html>