<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">I thought it was something along those lines, but didn’t look far enough… Some apache confg directives got moved around and my 443 virtual host was missing:</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class="">
<span style="font-variant-ligatures: no-common-ligatures" class=""> SSLEngine on</span></div>
<div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class="">
</span></div>
<div class="">D’oh! </div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Thank for the detailed answer and quick reply,</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Ian</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div>
<blockquote type="cite" class="">
<div class="">On Oct 26, 2018, at 4:25 PM, Nate Klingenstein <<a href="mailto:ndk@signet.id" class="">ndk@signet.id</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<meta name="Generator" content="Amazon WorkMail v3.0-4289" class="">
<title class="">RE: SP generated AssertionConsumerServiceURL not https</title>
<div class="">
<div style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
Ian,</div>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<div style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
Shibboleth constructs self-referential URL's when it needs to create redirects(such as the end AssertionConsumerService to place in an AuthnRequest) by pulling variables from the web environment to construct that URL. However you're triggering the authentication
request, it's apparently either coming in over http or you have something in your web server configuration that is forcing the scheme. I don't know if you used the built-in metadata generator, but if you did and it generated http URL's, that indicates that
you accessed the default metadata generator over http rather than https, as it does the same inspection of the inbound request.</div>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<div style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
You might look at how you're triggering the authentication request or re-configuring your web environment so that the proper scheme is returned, or you can enable handlerSSL="true" in the Sessions element, which will force all AssertionConsumerService endpoint
generation to use the HTTPS scheme instead.</div>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<div style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
<a href="https://wiki.shibboleth.net/confluence/display/SP3/Sessions" class="">https://wiki.shibboleth.net/confluence/display/SP3/Sessions</a></div>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<div style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
Thanks,</div>
<div style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
Nate.</div>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">
</p>
<blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px" class="">
-----Original message-----<br class="">
<strong class="">From:</strong> Altgilbers, Ian M<br class="">
<strong class="">Sent:</strong> Friday, October 26 2018, 1:59 pm<br class="">
<strong class="">To:</strong> <a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a><br class="">
<strong class="">Subject:</strong> SP generated AssertionConsumerServiceURL not https<br class="">
<br class="">
<!-- begin sanitized html -->
<div class="bodyclass">
<div class="">
<div class="">I am setting up a new RHEL7 server with apache 2.4 and:</div>
<div class="">shibboleth-3.0.2-1.1.x86_64</div>
<div class=""> </div>
<div class="">I configured my shibboleth2.xml config file like I have on several other hosts (with shibboleth 2.x), but when I go to collect my SP metadata to provide to our IdP admins, all the the AssertionConsumerService Locations are http, instead of https. </div>
<div class=""> </div>
<div class="">Apache is only listening on port 80 in order to redirect to 443… I have been able to get around this by having Apache do a 307 redirect to https, but that’s masking the problem.</div>
<div class=""> </div>
<div class="">I’ve tried setting the attribute: allowedSchemes=“https” in <SPConfig>, but it didn’t seem to have any effect.</div>
<div class=""> </div>
<div class="">I tried manually updating the SP metadata with https urls. Then, when I try to login, the AuthnRequest that the SP generates uses http:// for AssertionConsumerServiceURL, so the IdP can’t find a match and rejects me.</div>
<div class=""> </div>
<div class=""> </div>
<div class="">What could I be missing? Why would the SP’s metadata generator be producing http:// URLs? I’m accessing the SP over https...</div>
<div class=""> </div>
<div class=""> </div>
<div class="">Thanks,</div>
</div>
<div class=""> </div>
<div class=""> </div>
<div class="">
<div style="text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; word-wrap: break-word;" class="">
<div class="">Ian Altgilbers<br class="">
Senior Systems Administrator<br class="">
Educational Technology Services<br class="">
Tufts Technology Services<br class="">
Tufts University<br class="">
<br class="">
Phone: 617.627.0388<br class="">
<a title="This external link opens in a new window" href="http://it.tufts.edu/ests" class="">http://it.tufts.edu/ests</a></div>
</div>
</div>
</div>
<pre class="">--
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></pre>
<!-- end sanitized html --></blockquote>
</div>
-- <br class="">
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Ian Altgilbers<br class="">
Senior Systems Administrator<br class="">
Educational Technology Services<br class="">
Tufts Technology Services<br class="">
Tufts University<br class="">
<br class="">
Phone: 617.627.0388<br class="">
<a href="http://it.tufts.edu/ests" class="">http://it.tufts.edu/ests</a></div>
</div>
</div>
<br class="">
</div>
</body>
</html>