<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Andrej,
<div class=""><br class="">
</div>
<div class="">You’ll need to configure the web environment in which the IdP is running so that the IdP thinks that it’s receiving requests over the https:// scheme. Doing so is container dependent. Here is some documentation for the two supported containers.</div>
<div class=""><br class="">
</div>
<div class=""><a href="http://wiki.eclipse.org/Jetty/Howto/Configure_mod_proxy" class="">http://wiki.eclipse.org/Jetty/Howto/Configure_mod_proxy</a></div>
<div class=""><a href="https://tomcat.apache.org/tomcat-8.0-doc/config/http.html" class="">https://tomcat.apache.org/tomcat-8.0-doc/config/http.html</a></div>
<div class=""><br class="">
</div>
<div class="">The general rule of virtualization is that the servlet container environment needs to be configured so that it thinks it is the user-facing endpoint.</div>
<div class=""><br class="">
</div>
<div class="">Hope this helps,</div>
<div class="">Nate.</div>
<div class="">
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Sep 21, 2015, at 3:05 AM, Andrej Gregorka <<a href="mailto:Andrej.Gregorka@ixtlan-team.si" class="">Andrej.Gregorka@ixtlan-team.si</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
I have IDP deployed behind SSL endpoint. If I connect to IDP using AJP everything works fine:<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: 35.4pt;" class="">
ProxyPass /idp/ ajp:// xxx.xxx.xxx.xxx:8009/idp/ <o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: 35.4pt;" class="">
ProxyPassReverse /idp/ ajp:// xxx.xxx.xxx.xxx:8009/idp/ <o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
However, I will not be able to use AJP in production, so I have to connect from proxy using http. If I change to http:<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
ProxyPass /idp/ <span class="Apple-converted-space"> </span><a href="http://xxx.xxx.xxx.xxx.si:8080/idp/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">http://xxx.xxx.xxx.xxx.si:8080/idp/</a> <o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
ProxyPassReverse /idp/ http:// xxx.xxx.xxx.xxx:8080/idp/ <o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
I get the following error in idp-process.log:<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
10:09:40.817 - ERROR [org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder:215] - SAML message intended destination endpoint<span style="color: red;" class="">'<a href="https://domain/idp/profile/SAML2/Redirect/SSO'" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">https</a></span><a href="https://domain/idp/profile/SAML2/Redirect/SSO'" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">://domain/idp/profile/SAML2/Redirect/SSO'</a><span class="Apple-converted-space"> </span>did
not match the recipient endpoint<span style="color: red;" class="">'http</span>:// domain /idp/profile/SAML2/Redirect/SSO'<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
10:09:40.818 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:406] - Message did not meet security requirements<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
In idp-access.log:<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
20150921T084714Z|10.10.10.161|domain:80|/profile/SAML2/Redirect/SSO|<o:p class=""></o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<o:p class=""> </o:p></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
How can I get the IDP working behind proxy using the http connection?<o:p class=""></o:p></div>
</div>
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">To
unsubscribe from this list send an email to<span class="Apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</body>
</html>