Shibboleth 2.5.3 SP looping after successful POST

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2016-10-21 21:52]:
> Setting handlerSSL to false implies not using TLS, so setting
> cookieProps to https and then using http to access a site is a
> guaranteed loop. Session created, cookie set for https, resource
> access with http, no cookie, no session, loop.

Unless there's a redirect from http to https in there somewhere.

Without that the endpoint in the SP probably wouldn't match the SP's
metadata at the IDP (provided that only has HTTPS endpoints /and/ the
IDP validates ACS URLs, a spec requirement for unsigned requests, IIRC).
-peter