<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 12/17/15 3:35 PM, Rich Graves wrote:<br>
</div>
<blockquote
cite="mid:1491199320.12767659.1450384520009.JavaMail.zimbra@carleton.edu"
type="cite">
<pre wrap="">
If I use upper case <a class="moz-txt-link-freetext" href="HTTPS://">HTTPS://</a>, the IdP chokes here:
2015-12-17 13:45:29,280 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:411] - Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint at location <a class="moz-txt-link-freetext" href="HTTPS://hub-dev.its.carleton.edu:443/WebAdvisor/WebAdvisor">HTTPS://hub-dev.its.carleton.edu:443/WebAdvisor/WebAdvisor</a> using binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
org.opensaml.messaging.handler.MessageHandlerException: Relying party endpoint used the untrusted URL scheme HTTPS
</pre>
</blockquote>
<br>
Yeah, this is arguably a bug. We should probably be performing the
scheme eval in a case-insensitive manner. Please open a bug against
OpenSAML 3 for that (OSJ).<br>
<br>
<blockquote
cite="mid:1491199320.12767659.1450384520009.JavaMail.zimbra@carleton.edu"
type="cite">
<pre wrap="">
(How) can I define "HTTPS" as a trusted URL scheme? Other approaches?</pre>
</blockquote>
<br>
<br>
The trusted schemes are actually configurable, although in looking
at it now, it's not terribly convenient vis-a-vis Spring. I.e.
there's not a simple bean on which one can just set properties.
Need to invoke a static method on a class. <br>
<br>
As a workaround for now, try adding something like this to your
conf/global.xml. Essentially it's just adding in "HTTPS" to the
otherwise defaults of "http" and "https".<br>
<br>
<tt> <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"
depends-on="shibboleth.OpenSAMLConfig"><br>
<property name="targetClass"
value="org.opensaml.saml.config.SAMLConfigurationSupport"/><br>
<property name="targetMethod"
value="setAllowedBindingURLSchemes"/><br>
<property name="arguments"><br>
<list><br>
<util:list><br>
<value>http</value><br>
<value>https</value><br>
<value>HTTPS</value><br>
</util:list><br>
</list><br>
</property><br>
</bean></tt><br>
<tt></tt>
<blockquote
cite="mid:1491199320.12767659.1450384520009.JavaMail.zimbra@carleton.edu"
type="cite">
</blockquote>
<br>
<br>
I'm not 100% sure about the 'arguments' property value, and can't
easily test at the moment. If someone else happens to know or see a
mistake please speak up. The <tt>MethodInvokingFactoryBean
setArguments </tt>takes an Object[]. The actual invoked OpenSAML
method needs to take a List<String>. So I think something
like specifying a <list> value for the former with a single
<util:list> bean member value should work. But may need a
little tweaking.<br>
<br>
<br>
</body>
</html>