Help Needed with SP HTTPS Reverse Proxy

[David E. Newswanger]

Hi Everyone,


I have a PHP application running on an Apache SP in a Docker container. Apache is set up to accept HTTP connections from my proxy (Traefik), which handles HTTPS requests.


I've been following this article: https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy and I configured the SP to not handle SSL requests as shown below:


        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                  checkAddress="false" handlerSSL="false" cookieProps="https">


I've also configured the metadata so that it uses HTTPS endpoints:


    [...]

    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://our.host.edu/Shibboleth.sso/SAML2/POST" index="1"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://our.host.edu/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/>
    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://our.host.edu/Shibboleth.sso/SAML2/Artifact" index="3"/>
    [...]

The proxy is successfully routing requests to the SP, so when I open up https://our.host.edu/Shibboleth.sso/Metadata, or any of the other endpoints it connects correctly, however when anyone attempts to access a protected endpoint they get the following message on the IDP: Web Login Service - Unable to Respond.

Checking the IDP logs shows the following warnings:

idp_1  | 2017-09-29 18:27:09,397 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:375] - Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService for outbound message
idp_1  | 2017-09-29 18:27:09,401 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:516] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest
idp_1  | 2017-09-29 18:27:09,405 - WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:410] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint for relying party 'https://our.host.edu/shibboleth': EndpointCriterion [type={urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService, Binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, Location=http://our.host.edu/Shibboleth.sso/SAML2/POST, trusted=false]
idp_1  | 2017-09-29 18:27:09,483 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: EndpointResolutionFailed

The interesting thing here is that the IDP seems to be hitting an HTTP endpoint (which is inactive), rather than the HTTPS endpoint that I configured in the metadata. I double checked the metadata for this SP a few times and I can't see any reason why the IDP is doing this.

I've run out of ideas about what might be going wrong here, and I was wondering if any of you guys might be able to point me in the right direction?


Thanks,

    David Newswanger
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170929/2388aa46/attachment.html>