IDP 3 SSL off-load

[Tom Scavo]

On Thu, Jun 16, 2016 at 12:23 PM, Robert Duncan <Robert.Duncan at ncirl.ie> wrote:
>
> After a in place upgrade from 2.3 to 3.2.1 runiing on Windows I get the following error from message handler
>
> Message Handler:  Checking SAML message intended destination endpoint against receiver endpoint
> 2016-06-16 15:30:10,010 - DEBUG [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:190] - Message Handler:  Intended message destination endpoint: https://idp.ncirl.ie/idp/profile/SAML2/Redirect/SSO
> 2016-06-16 15:30:10,010 - DEBUG [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:191] - Message Handler:  Actual message receiver endpoint: http://idp.ncirl.ie/idp/profile/SAML2/Redirect/SSO
> 2016-06-16 15:30:10,010 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:200] - Message Handler:  SAML message intended destination endpoint 'https://idp.ncirl.ie/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'http://idp.ncirl.ie/idp/profile/SAML2/Redirect/SSO'
> 2016-06-16 15:30:10,010 - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:182] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
> org.opensaml.messaging.handler.MessageHandlerException: SAML message failed received endpoint check
>
> it's endpoint schema mismatch, I am using the jetty container behind IIS proxy and SSL is offloaded at a network load balancer.
>
> I have SSL on LB and also a self signed on IIS for MITM - what is the authoritative source for endpoints? Because in the meatadata and in reality there is a message receiver on the https schema, since I already have 2 ssl certificates and want to ignore jetty completely how can I 'tell' the IDP what the endpoints are, and why is the 'Actual message receiver endpoint' http now. - Presumably this is something I have to configure in Jetty?

This issue is resolved in the archives. Search:

shibboleth "intended destination endpoint" "did not match the
recipient endpoint"

on google.

Tom