<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4289">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: SP generated AssertionConsumerServiceURL not https</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Ian,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Shibboleth constructs self-referential URL's when it needs to create redirects(such as the end AssertionConsumerService to place in an AuthnRequest) by pulling variables from the web environment to construct that URL. However you're triggering the authentication request, it's apparently either coming in over http or you have something in your web server configuration that is forcing the scheme. I don't know if you used the built-in metadata generator, but if you did and it generated http URL's, that indicates that you accessed the default metadata generator over http rather than https, as it does the same inspection of the inbound request.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">You might look at how you're triggering the authentication request or re-configuring your web environment so that the proper scheme is returned, or you can enable handlerSSL="true" in the Sessions element, which will force all AssertionConsumerService endpoint generation to use the HTTPS scheme instead.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">https://wiki.shibboleth.net/confluence/display/SP3/Sessions</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Thanks,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Nate.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Altgilbers, Ian M<br /><strong>Sent:</strong> Friday, October 26 2018, 1:59 pm<br /><strong>To:</strong> users@shibboleth.net<br /><strong>Subject:</strong> SP generated AssertionConsumerServiceURL not https<br /><br /><!-- begin sanitized html --><div class="bodyclass"><div><div>I am setting up a new RHEL7 server with apache 2.4 and:</div><div>shibboleth-3.0.2-1.1.x86_64</div><div> </div><div>I configured my shibboleth2.xml config file like I have on several other hosts (with shibboleth 2.x), but when I go to collect my SP metadata to provide to our IdP admins, all the the AssertionConsumerService Locations are http, instead of https. </div><div> </div><div>Apache is only listening on port 80 in order to redirect to 443… I have been able to get around this by having Apache do a 307 redirect to https, but that’s masking the problem.</div><div> </div><div>I’ve tried setting the attribute: allowedSchemes=“https” in <SPConfig>, but it didn’t seem to have any effect.</div><div> </div><div>I tried manually updating the SP metadata with https urls. Then, when I try to login, the AuthnRequest that the SP generates uses http:// for AssertionConsumerServiceURL, so the IdP can’t find a match and rejects me.</div><div> </div><div> </div><div>What could I be missing? Why would the SP’s metadata generator be producing http:// URLs? I’m accessing the SP over https...</div><div> </div><div> </div><div>Thanks,</div></div><div> </div><div> </div> <div><div style="color:#000000; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; word-wrap:break-word"><div>Ian Altgilbers<br />Senior Systems Administrator<br />Educational Technology Services<br />Tufts Technology Services<br />Tufts University<br /><br />Phone: 617.627.0388<br /><a title="This external link opens in a new window" href="http://it.tufts.edu/ests">http://it.tufts.edu/ests</a></div></div></div></div><pre>--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre> <!-- end sanitized html --></blockquote>
</body>
</html>