Thanks, Kevin<div><br clear="all"><div>Dominic</div><br>
<br><br><div class="gmail_quote">On Thu, Oct 18, 2012 at 1:32 PM, Kevin P. Foote <span dir="ltr"><<a href="mailto:kpfoote@iup.edu" target="_blank">kpfoote@iup.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Dominic,<br>
<br>
-> We have a Shibboleth Service Provider (2.4.3) set up on Windows webservers<br>
-> behind a firewall. The firewall offloads the SSL work and sends traffic to<br>
-> our webservers over http.<br>
-> Our metadata includes only https ACSs. However, when a user tries to<br>
-> authenticate, the authnrequest is passing http endpoints. Consequently, the<br>
-> IdP is getting the "no endpoint, with that URL and using a supported<br>
<br>
<br>
You have to ensure that the webserver is responding correctly.<br>
<br>
In your case this is not happening. Your webserver is responding as http<br>
when it should be responding as https.. If you are accessing a https site<br>
then the webserver needs to respond as such regardless of what hardware<br>
is sitting in between the browser and the webserver.<br>
<br>
This topic has been covered on list numerous times and is also covered<br>
in the wiki.<br>
<br>
Search list for "load balanced SP" or "SP https offload" or some other<br>
variant of that nature.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPGettingStarted</a><br>
<br>
Example: With apache this is done with the ServerName variable ..<br>
<br>
<br>
------<br>
thanks<br>
kevin.foote<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>