<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Hi Everyone,</p>
<p><br>
</p>
<p>I have a PHP application running on an Apache SP in a Docker container. Apache is set up to accept HTTP connections from my proxy (Traefik), which handles HTTPS requests.</p>
<p><br>
</p>
<p>I've been following this article: <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy" class="OWAAutoLink" id="LPlnk836007" previewremoved="true">
https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy</a> and I configured the SP to not handle SSL requests as shown below:<br>
</p>
<p><br>
</p>
<p></p>
<div> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<br>
checkAddress="false" handlerSSL="false" cookieProps="https"></div>
<br>
<p></p>
<p>I've also configured the metadata so that it uses HTTPS endpoints:</p>
<p><br>
</p>
<p> [...]<br>
</p>
<p></p>
<div> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://<i>our.host.edu</i>/Shibboleth.sso/SAML2/POST" index="1"/><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://<i>our.host.edu</i>/Shibboleth.sso/SAML2/POST-SimpleSign" index="2"/><br>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://<i>our.host.edu</i>/Shibboleth.sso/SAML2/Artifact" index="3"/><br>
</div>
<div> [...]</div>
<div><br>
</div>
<div>The proxy is successfully routing requests to the SP, so when I open up <a href="https://our.host.edu/Shibboleth.sso/Metadata" class="OWAAutoLink" id="LPlnk393359" previewremoved="true">
https://our.host.edu/Shibboleth.sso/Metadata</a>, or any of the other endpoints it connects correctly, however when anyone attempts to access a protected endpoint they get the following message on the IDP:
<span>Web Login Service - Unable to Respond</span>.</div>
<div><br>
</div>
<div>Checking the IDP logs shows the following warnings:</div>
<div><br>
</div>
<div>
<div>idp_1 | 2017-09-29 18:27:09,397 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:375] - Profile Action PopulateBindingAndEndpointContexts: Attempting to resolve endpoint of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService
for outbound message<br>
idp_1 | 2017-09-29 18:27:09,401 - DEBUG [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:516] - Profile Action PopulateBindingAndEndpointContexts: Populating template endpoint for resolution from SAML AuthnRequest<br>
idp_1 | 2017-09-29 18:27:09,405 - WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:410] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint for relying party 'https://<i>our.host.edu</i>/shibboleth':
EndpointCriterion [type={urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService, Binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST, Location=http://<i>our.host.edu</i>/Shibboleth.sso/SAML2/POST, trusted=false]<br>
idp_1 | 2017-09-29 18:27:09,483 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: EndpointResolutionFailed<br>
<br>
</div>
The interesting thing here is that the IDP seems to be hitting an HTTP endpoint (which is inactive), rather than the HTTPS endpoint that I configured in the metadata. I double checked the metadata for this SP a few times and I can't see any reason why the IDP
is doing this.<br>
</div>
<div><br>
</div>
<div>I've run out of ideas about what might be going wrong here, and I was wondering if any of you guys might be able to point me in the right direction?<br>
</div>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif,"EmojiFont","Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols;">
<p>Thanks,<br>
</p>
<p> David Newswanger</p>
</div>
</div>
</div>
</body>
</html>