Issue with Shibboleth SP - Endpoint Mismatch Error

[Luan Trindade]

Hello, I’m having an issue with Shibboleth. I have a few SPs, and when I
attempt to access the IdP through them, the following error is returned in
the log:

"Message Handler: SAML message intended destination endpoint '
https://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO' did not match the
recipient endpoint 'http://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO'"

I’m using Apache and Jetty (version 11.0.17).

Apache configuration file:
<VirtualHost *:80>
    ServerName FQDN.DOMAIN.br

    CustomLog /var/log/apache2/dev.access.log combined
    ErrorLog /var/log/apache2/dev.error.log

    ProxyPreserveHost On
    Redirect permanent "/" "https://FQDN.DOMAIN.br/"

</VirtualHost>

<VirtualHost *:443>
    ServerName FQDN.DOMAIN.br

    CustomLog /var/log/apache2/FQDN.access.log combined
    ErrorLog /var/log/apache2/FQDN.error.log

    SSLEngine On
    SSLCompression off
    SSLCACertificateFile /etc/ssl/certs/CER.pem
    SSLCertificateChainFile /etc/ssl/certs/CER.pem
    SSLCertificateKeyFile /etc/ssl/private/CER.key
    SSLCertificateFile /etc/ssl/certs/CER.cer

    ProxyPreserveHost On
    ProxyVia On
    ProxyRequests Off
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"
    RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"
    ProxyPass /idp http://localhost:8080/idp
    ProxyPassReverse /idp http://localhost:8080/idp

</VirtualHost>

Jetty configuration file
[Unit]
Description=Jetty Web Server
After=network.target

[Service]
User=jetty
ExecStart=/usr/bin/java -jar /opt/jetty/start.jar jetty.http.port=8080
jetty.ssl.port=8443 --module=deploy,http,jsp,jstl,websocket,ext,resources
WorkingDirectory=/opt/jetty-base
Environment=JETTY_HOME=/opt/jetty
Environment=JETTY_BASE=/opt/jetty-base
Restart=on-failure

StandardOutput=append:/var/log/jetty/jetty.log
StandardError=append:/var/log/jetty/jetty_error.log

[Install]
WantedBy=multi-user.target

I have already checked the IdP metadata, and all the endpoints are using
HTTPS. What could I do in this case? Thank you!

-- 
*Luan Trindade*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241015/7edc805c/attachment.htm>