<div dir="ltr"><div><div><div>Peter,<br><br></div>Thanks for you reply. To be honest I am not very clear what I need to do in order to resolve the issue I am seeing. Could you please elaborate a little bit more?<br><br></div>
Maybe I need to switch direct to focus on letting Tomcat knows that there is a proxy in front of it, so that <code>request.getServerName() will return the proxy server name/port. In that case there would be no problem in matching the endpoint. Is that what you mean to set proxyPort for Tomcat?<br>
<br></code></div><code>Thanks,<br>Yaowen<br><br></code></div><div class="gmail_extra"><br clear="all"><div>Yaowen</div>
<br><br><div class="gmail_quote">On Wed, Sep 18, 2013 at 12:48 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Yaowen Tu <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> [2013-09-18 07:11]:<br>
<div class="im">> SAML message intended destination endpoint<br>
> '<a href="http://sma-pc1:8080/idp/profile/SAML2/POST/SSO" target="_blank">http://sma-pc1:8080/idp/profile/SAML2/POST/SSO</a>' did not match<br>
> the recipient endpoint<br>
> '<a href="http://sma-pc1:8900/idp/profile/SAML2/POST/SSO" target="_blank">http://sma-pc1:8900/idp/profile/SAML2/POST/SSO</a>'<br>
<br>
</div>IMO this means you haven't virtualized all URLs correctly, i.e., the IdP<br>
must be configured with the schema, hostname and port which is seen<br>
externally, from your HTTP user agent. The physical port etc. should<br>
be irrelevant in any Shib/SAML related setting, incl metadata.<br>
For Tomcat you'll probably need to set proxyPort (and scheme, if<br>
you're terminating TLS/SSL on the proxy) on the relevant Connector.<br>
<span class="HOEnZb"><font color="#888888">-peter<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>