<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 11 Mar 2020, at 15:32, Gustavo Duarte <<a href="mailto:gus.duarte@gmail.com" class="">gus.duarte@gmail.com</a>> wrote:</div>
<div class="">
<div dir="ltr" class=""><br class="">
<div class=""><br class="">
</div>
2020-03-11 14:32:00,831 - 127.0.0.1 - ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:200] - Message Handler: SAML message intended destination endpoint '<a href="https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO" class="">https://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO</a>'
did not match the recipient endpoint '<a href="http://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO" class="">http://idp.gusduarte.tech/idp/profile/SAML2/Redirect/SSO</a>’</div>
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">Gustavo,</div>
<div class=""><br class="">
</div>
<div class="">As luck would have it, I ran into the same problem this morning. For me, this was due to Tomcat not understanding that the real HTTP traffic (being terminated by Apache httpd) was done over https.</div>
<div class=""><br class="">
</div>
<div class="">My fix was to amend the <Connector> block and add a “Valve” to the Tomcat server.xml’s <Engine> block:</div>
<div class=""><br class="">
</div>
<div class="">
<div class=""> <Valve className="org.apache.catalina.valves.RemoteIpValve"</div>
<div class=""> internalProxies=“10.1.2.0/16"</div>
<div class=""> remoteIpHeader="x-forwarded-for"</div>
<div class=""> remoteIpProxiesHeader="x-forwarded-by"</div>
<div class=""> protocolHeader="x-forwarded-proto"</div>
<div class=""> /></div>
</div>
<div class=""><br class="">
</div>
<div class="">Connector might now look like:</div>
<div class=""><br class="">
</div>
<div class=""><Connector address=“..." port=“8080" protocol="HTTP/1.1" proxyPort="443" scheme="https" secure="true" /></div>
<div class=""><br class="">
</div>
<div class="">Hope that helps!</div>
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div>-- </div>
<div><b class="">Matthew Slowe</b></div>
<div><b class="">Technical Specialist - Trust & Identity</b><br class="">
<br class="">
</div>
<div>Jisc Trust and Identity Services<br class="">
UK Access Management Federation - Assent - Certificate Service and Domain Registry<br class="">
</div>
<div><br class="">
</div>
<div><a href="https://jisc.ac.uk/network/trust-and-identity" class="">https://jisc.ac.uk/network/trust-and-identity</a></div>
<div class=""><br class="">
</div>
</div>
</div>
</div>
</div>
</div>
<div class=""><br class="">
</div>
</body>
</html>