Idp behind SSL endpoint without AJP

[Nate Klingenstein]

Andrej,

You’ll need to configure the web environment in which the IdP is running so that the IdP thinks that it’s receiving requests over the https:// scheme.  Doing so is container dependent.  Here is some documentation for the two supported containers.

http://wiki.eclipse.org/Jetty/Howto/Configure_mod_proxy
https://tomcat.apache.org/tomcat-8.0-doc/config/http.html

The general rule of virtualization is that the servlet container environment needs to be configured so that it thinks it is the user-facing endpoint.

Hope this helps,
Nate.

On Sep 21, 2015, at 3:05 AM, Andrej Gregorka <Andrej.Gregorka at ixtlan-team.si<mailto:Andrej.Gregorka at ixtlan-team.si>> wrote:

I have IDP deployed behind SSL endpoint. If I connect to IDP using AJP everything works fine:
ProxyPass           /idp/           ajp:// xxx.xxx.xxx.xxx:8009/idp/
ProxyPassReverse    /idp/           ajp:// xxx.xxx.xxx.xxx:8009/idp/


However, I will not be able to use AJP in production, so I have to connect from proxy using http. If I change to http:
          ProxyPass           /idp/           http://xxx.xxx.xxx.xxx.si:8080/idp/
         ProxyPassReverse    /idp/           http:// xxx.xxx.xxx.xxx:8080/idp/


I get the following error in idp-process.log:
10:09:40.817 - ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML message intended destination endpoint'https<https://domain/idp/profile/SAML2/Redirect/SSO'>://domain/idp/profile/SAML2/Redirect/SSO'<https://domain/idp/profile/SAML2/Redirect/SSO'> did not match the recipient endpoint'http:// domain /idp/profile/SAML2/Redirect/SSO'
10:09:40.818 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements


In idp-access.log:
20150921T084714Z|10.10.10.161|domain:80|/profile/SAML2/Redirect/SSO|


How can I get the IDP working behind proxy using the http connection?
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150921/c17ec630/attachment.html>