Idp behind SSL endpoint without AJP

[Andrej Gregorka]

I managed to get it working by setting header X-Forwarded-Proto to https.

That way servlet container thinks (in my case Widlfly) its https.


Thanks everyone for the help.

Andrej

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: Monday, September 21, 2015 11:19 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Idp behind SSL endpoint without AJP

Andrej,

You’ll need to configure the web environment in which the IdP is running so that the IdP thinks that it’s receiving requests over the https:// scheme.  Doing so is container dependent.  Here is some documentation for the two supported containers.

http://wiki.eclipse.org/Jetty/Howto/Configure_mod_proxy
https://tomcat.apache.org/tomcat-8.0-doc/config/http.html

The general rule of virtualization is that the servlet container environment needs to be configured so that it thinks it is the user-facing endpoint.

Hope this helps,
Nate.

On Sep 21, 2015, at 3:05 AM, Andrej Gregorka <Andrej.Gregorka at ixtlan-team.si<mailto:Andrej.Gregorka at ixtlan-team.si>> wrote:

I have IDP deployed behind SSL endpoint. If I connect to IDP using AJP everything works fine:
ProxyPass           /idp/           ajp:// xxx.xxx.xxx.xxx:8009/idp/
ProxyPassReverse    /idp/           ajp:// xxx.xxx.xxx.xxx:8009/idp/


However, I will not be able to use AJP in production, so I have to connect from proxy using http. If I change to http:
          ProxyPass           /idp/           http://xxx.xxx.xxx.xxx.si:8080/idp/
         ProxyPassReverse    /idp/           http:// xxx.xxx.xxx.xxx:8080/idp/


I get the following error in idp-process.log:
10:09:40.817 - ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML message intended destination endpoint'https<https://domain/idp/profile/SAML2/Redirect/SSO'>://domain/idp/profile/SAML2/Redirect/SSO'<https://domain/idp/profile/SAML2/Redirect/SSO'> did not match the recipient endpoint'http:// domain /idp/profile/SAML2/Redirect/SSO'
10:09:40.818 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements


In idp-access.log:
20150921T084714Z|10.10.10.161|domain:80|/profile/SAML2/Redirect/SSO|


How can I get the IDP working behind proxy using the http connection?
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150921/149743bf/attachment-0001.html>