Software-Based Clustering [Ubuntu 12.04]

[Manuel Haim]

Hi Ricardo,

it looks like your IdPv3 thinks you have called it via http:// rather
than https:// (which is true in some way, since HAProxy does the SSL
offloading and speaks plain http with your IdP).

Did you tell your servlet container (i.e. Tomcat or Jetty) to handle
incoming requests as https?

With IdPv2 on Tomcat, this is done by setting scheme="https" within
Tomcat's config file "server.xml" , for example like this:
<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               URIEncoding="UTF-8"
               proxyPort="443" scheme="https"
               tomcatAuthentication="false"
               maxPostSize="100000"
               redirectPort="8443" />

For Jetty, I have found the following documentation:
https://wiki.eclipse.org/Jetty/Howto/Configure_mod_proxy#Proxying_SSL_on_Apache_to_HTTP_on_Jetty

I don't know if IdPv3 needs an additional setting to handle incoming
http requests as https, though.

Kind regards,
Manuel


Am 25.09.2015 um 15:52 schrieb Ricardo T. Macedo:
> Hi Manuel,
> 
>  Thank you for the instructions. I’m following your suggestion using
> only the HAProxy and IdP v3. However, I receive this error:
> 
> 2015-09-23 10:54:34,101 - ERROR
> [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:199]
> - Message Handler:  SAML message intended destination endpoint
> 'https://idp1v3.fedexpresso.edu.br/idp/profile/SAML2/Redirect/SSO' did
> not match the recipient endpoint
> 'http://idp1v3.fedexpresso.edu.br/idp/profile/SAML2/Redirect/SSO'
> 2015-09-23 10:54:34,109 - WARN
> [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182] -
> Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
> org.opensaml.messaging.handler.MessageHandlerException: SAML message
> failed received endpoint check
>         at
> org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler.checkEndpointURI(ReceivedEndpointSecurityHandler.java:201)
> 
>  Please find the HAProxy configuration file and the environment
> illustration attached to this email.
> 
>  Do have any idea about how I can solve this problem?
> 
> Best regards,
> Ricardo