<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">
<div class="">I am setting up a new RHEL7 server with apache 2.4 and:</div>
<div class="">shibboleth-3.0.2-1.1.x86_64</div>
<div class=""><br class="">
</div>
<div class="">I configured my shibboleth2.xml config file like I have on several other hosts (with shibboleth 2.x), but when I go to collect my SP metadata to provide to our IdP admins, all the the AssertionConsumerService Locations are http, instead of https. </div>
<div class=""><br class="">
</div>
<div class="">Apache is only listening on port 80 in order to redirect to 443… I have been able to get around this by having Apache do a 307 redirect to https, but that’s masking the problem.</div>
<div class=""><br class="">
</div>
<div class="">I’ve tried setting the attribute: allowedSchemes=“https” in <SPConfig>, but it didn’t seem to have any effect.</div>
<div class=""><br class="">
</div>
<div class="">I tried manually updating the SP metadata with https urls. Then, when I try to login, the AuthnRequest that the SP generates uses http:// for AssertionConsumerServiceURL, so the IdP can’t find a match and rejects me.</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">What could I be missing? Why would the SP’s metadata generator be producing http:// URLs? I’m accessing the SP over https...</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Ian Altgilbers<br class="">
Senior Systems Administrator<br class="">
Educational Technology Services<br class="">
Tufts Technology Services<br class="">
Tufts University<br class="">
<br class="">
Phone: 617.627.0388<br class="">
<a href="http://it.tufts.edu/ests" class="">http://it.tufts.edu/ests</a></div>
</div>
</div>
<br class="">
</body>
</html>