<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>So it seems I’m stuck here. I emailed the jetty users list and they indicated it was a shibboleth issue, re:</div>
<div><br>
</div>
<div>---</div>
<div>
<div style="font-family: -webkit-standard;">The fact that the directory says "embedded/jetty-base/" means that its</div>
<div style="font-family: -webkit-standard;">likely NOT using the jetty-distribution, and the configuration you are</div>
<div style="font-family: -webkit-standard;">doing isn't being applied like you think it is. You'll need to understand,</div>
<div style="font-family: -webkit-standard;">intimately, how Shibboleth configures itself, then you can configure it</div>
<div style="font-family: -webkit-standard;">according to its techniques.</div>
</div>
<div>—</div>
<div><br>
</div>
<div>How would I troubleshoot this?</div>
<div><br>
</div>
<div>regards,</div>
<div>Ryan</div>
<div><br>
</div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE"></div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>suarezry <<a href="mailto:ryan.suarez@sheridancollege.ca">ryan.suarez@sheridancollege.ca</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, June 22, 2016 at 9:42 AM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>SAML message intended destination endpoint did not match the recipient endpoint<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
I’m installing shib IdP v3.2.1 on ubuntu14.04 with jetty v9.3.9. This will be behind load balancers, F5 bigip v11.5.3. SSL will be terminated at the load balancer, ie:</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
Client —(https:443)—> F5 —(http:8080)—> IdP</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, sans-serif; font-size: 14px; color: rgb(0, 0, 0);">
I’m getting this error:</div>
<div>
<p style="font-family: Monaco; font-size: 10px; margin: 0px; line-height: normal;">
2016-06-22 08:31:53,704 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:200] - Message Handler: SAML message intended destination endpoint '<a href="https://myidp.mydomain.ca/idp/profile/SAML2/Redirect/SSO">https://myidp.mydomain.ca/idp/profile/SAML2/Redirect/SSO</a>'
did not match the recipient endpoint '<a href="http://myidp.mydomain.ca/idp/profile/SAML2/Redirect/SSO">http://myidp.mydomain.ca/idp/profile/SAML2/Redirect/SSO</a>'</p>
<p style="font-family: Monaco; font-size: 10px; margin: 0px; line-height: normal;">
<br>
</p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri,sans-serif">I’ve already added the required configuration to offload TLS and the load balancer is inserting X-Forwarded-For (<clientIP) and X-Forwarded-Proto (https), but I’m still getting the
error. Any ideas how to fix this? </font></p>
<p style="margin: 0px; line-height: normal;"><br>
</p>
<p style="margin: 0px; line-height: normal;"><font face="Calibri,sans-serif">This is my shibboleth-identity-provider-3.2.1/embedded/jetty-base/etc/jetty.xml:</font></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<span style="background-color: rgb(0, 0, 0); color: rgb(245, 245, 245);"> </span> <New id="httpConfig" class="org.eclipse.jetty.server.HttpConfiguration"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="secureScheme">https</Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="securePort"><Property name="jetty.secure.port" default="443" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="outputBufferSize"><Property name="jetty.output.buffer.size" default="32768" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="requestHeaderSize"><Property name="jetty.request.header.size" default="8192" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="responseHeaderSize"><Property name="jetty.response.header.size" default="8192" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="sendServerVersion"><Property name="jetty.send.server.version" default="true" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="sendDateHeader"><Property name="jetty.send.date.header" default="false" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="headerCacheSize">512</Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Call name="addCustomizer"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Arg><New class="org.eclipse.jetty.server.ForwardedRequestCustomizer"/></Arg></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</Call></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</New></p>
<p style="margin: 0px; line-height: normal;"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco; min-height: 14px;">
<br>
</p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Call name="addConnector"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Arg></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<New class="org.eclipse.jetty.server.ServerConnector"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Arg name="server"><Ref refid="Server" /></Arg></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Arg name="factories"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Array type="org.eclipse.jetty.server.ConnectionFactory"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Item></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<New class="org.eclipse.jetty.server.ProxyConnectionFactory"/></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</Item></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Item></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<New class="org.eclipse.jetty.server.HttpConnectionFactory"></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Arg name="config"><Ref refid="httpConfig" /></Arg></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</New></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</Item></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</Array></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</Arg></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="host"><Property name="jetty.nonhttps.host" default="localhost" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="port"><Property name="jetty.nonhttps.port" default="8080" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="idleTimeout"><Property name="http.timeout" default="30000" /></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
<Set name="soLingerTime"><Property name="http.soLingerTime" default="-1"/></Set></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</New></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</Arg></p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco; min-height: 14px;">
</p>
<p style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco;">
</Call></p>
</div>
<div><br>
</div>
<div>Regards,</div>
<div>Ryan Suarez</div>
</div>
</div>
</blockquote>
</span>
</body>
</html>