SP setup with SSL offload on F5

[Peter Schober]

* Mathew, Sunil <smathew at hbs.edu> [2019-01-31 19:37]:
> In Dev, I configured SSL certificate on IIS and everything worked as
> expected. In Prod, SSL is offloaded on F5. There is no SSL
> certificate setup on IIS (and no ‘https’ binding). I configured
> Shibboleth SP with handlerSSL="false".

Do you still think setting handlerSSL="false" means the webserver will
be made aware that SSL offloading is happening and adjusting its
internal workings accordingly, even *after* having looked at the
documentation for the handlerSSL config parameter?
https://wiki.shibboleth.net/confluence/display/SP3/Sessions

> Now I am getting 500 with the following error:
> POST targeted at
> (https://housing-prod.abc.edu/Shibboleth.sso/SAML2/POST), but
> delivered to (http://housing-prod.abc.edu/Shibboleth.sso/SAML2/POST)

That's to be expected. You'll need to make the SP aware of the
effective logical schema (https instead of http) and port (443 instead
of 80) using the provided methods:
https://wiki.shibboleth.net/confluence/display/SP3/SSLOffloading

> PS: Environment is Shibboleth Windows SP 3.0.3 on IIS 10 running on
> Windows Server 2016. I modified all the urls in the SP metadata
> configured on the IdP from ‘http’ to ‘https’.

Once you have virtualized schema and port properly the SP should
create "correct" metadata at the /Shibboleth.sso/Metadata endpoint,
without editing.

Also the metagen script provided with the SP should always allow you
to easily generate metadata using multiple options, without editing
basics such as the base URL in the generated XML.

-peter