Shibboleth 2.5.3 SP looping after successful POST

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2016-10-21 21:56]:
> * Cantor, Scott <cantor.2 at osu.edu> [2016-10-21 21:52]:
> > Setting handlerSSL to false implies not using TLS, so setting
> > cookieProps to https and then using http to access a site is a
> > guaranteed loop. Session created, cookie set for https, resource
> > access with http, no cookie, no session, loop.
> 
> Unless there's a redirect from http to https in there somewhere.

Ah, I see. Even without metadata errors at the IDP the SAML exchange
could always happen over HTTPS at the SP (depending on how sessions
are initiated and how the plain http and SSL vhosts are configured)
but site access could be over plain http, hence a loop with the
"secure" flag on session cookies.

We sometimes disable plain http access for services completely (and
often enough are asked to turn them back on again, later). A redirect
from http to https is then the only thing you get on http. STS headers
might help there, too.
-peter