Configure IdP url for login to be http

[Peter Schober]

* Calvin A <calvin.a at wph.com.sg> [2019-02-08 09:49]:
> From our service provider, for now, we are calling
> *https://<host>/idp/profile/SAML2/Redirect/SSO* to trigger the login
> url to Shibboleth.

The SP implementation should know where to send requests and how, but
maybe you already meant that? If you're doing that manually or
programmatically somehow you probably should't.

> Is it possible to configure https to be http? When we are trying to use
> http://<host>/idp/profile/SAML2/Redirect/SSO

Why? My own IDP doesn't even listen on plain HTTP at all (so not even
redirects from http to https -- an IDP is not meant to be accessed
directly out of context of some transaction).

> Or alternative question is, for http purpose, what would the IdP url
> needs to be used?  The configuration examples we always found is to
> use https only.

Since an IDP performs authentication and commercial web browser PKIX
is the only thing providing anything remotely resembling "security"
for the passing of the credentials from the browser to the webserver
why even bother with SAML or with standing up an IDP if you want that
to be snoopable and spoofable and provide no security at all?
(Comparare this with still providing a telnet service, not ssh.)

Having said all that, the software does not force you to use TLS and
you can configure and run an IDP on plain HTTP just fine.
(I.e., there's enough rope to hang yourself with.)

-peter