Hi,<div><br></div><div>We have a Shibboleth Service Provider (2.4.3) set up on Windows webservers behind a firewall. The firewall offloads the SSL work and sends traffic to our webservers over http. </div><div>Our metadata includes only https ACSs. However, when a user tries to authenticate, the authnrequest is passing http endpoints. Consequently, the IdP is getting the "no endpoint, with that URL and using a supported binding, can be found in the relying party's metadata" error. My guess is that's happening because by the time the traffic is hitting our SP, Shibboleth sees it as unencrypted (because it is), and so it generates requests based on that. Is that a fair assumption? If so, is there a way that I can tell Shibboleth to only generate requests with https endpoints? I can't use handlerSSL="false" because the firewall is sending the requests over http.</div>
<div><br></div><div>Thanks in advance,</div>
<div><br></div><div>Dominic<br><br>
</div>