<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div dir="ltr"></div>
<div dir="ltr">You redacted the log message. Is “FQDN.DOMAIN” exactly the same in both the destination and recipient endpoints? If so, this shouldn’t happen, as they do match. </div>
<div dir="ltr"><br>
</div>
<div dir="ltr">If they are different, see the mailing list archives for a similar issue I asked about recently. That turned out to be a client using an invalid host header in the request. </div>
<div dir="ltr"><br>
<div dir="ltr"></div>
<blockquote type="cite">On Oct 15, 2024, at 7:27 AM, Luan Trindade via users <users@shibboleth.net> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">Hello, I’m having an issue with Shibboleth. I have a few SPs, and when I attempt to access the IdP through them, the following error is returned in the log:<br>
<br>
"Message Handler: SAML message intended destination endpoint '<a href="https://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO">https://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO</a>' did not match the recipient endpoint '<a href="http://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO">http://FQDN.DOMAIN.br/idp/profile/SAML2/POST/SSO</a>'"<br>
<br>
I’m using Apache and Jetty (version 11.0.17).<br>
<br>
Apache configuration file:<br>
<VirtualHost *:80><br>
ServerName <a href="http://FQDN.DOMAIN.br">FQDN.DOMAIN.br</a><br>
<br>
CustomLog /var/log/apache2/dev.access.log combined<br>
ErrorLog /var/log/apache2/dev.error.log<br>
<br>
ProxyPreserveHost On<br>
Redirect permanent "/" "<a href="https://FQDN.DOMAIN.br/">https://FQDN.DOMAIN.br/</a>"<br>
<br>
</VirtualHost><br>
<br>
<VirtualHost *:443><br>
ServerName <a href="http://FQDN.DOMAIN.br">FQDN.DOMAIN.br</a><br>
<br>
CustomLog /var/log/apache2/FQDN.access.log combined<br>
ErrorLog /var/log/apache2/FQDN.error.log<br>
<br>
SSLEngine On<br>
SSLCompression off<br>
SSLCACertificateFile /etc/ssl/certs/CER.pem<br>
SSLCertificateChainFile /etc/ssl/certs/CER.pem<br>
SSLCertificateKeyFile /etc/ssl/private/CER.key<br>
SSLCertificateFile /etc/ssl/certs/CER.cer<br>
<br>
ProxyPreserveHost On<br>
ProxyVia On<br>
ProxyRequests Off<br>
RequestHeader set X-Forwarded-Proto "https"<br>
RequestHeader set X-Forwarded-Port "443"<br>
RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"<br>
ProxyPass /idp <a href="http://localhost:8080/idp">http://localhost:8080/idp</a><br>
ProxyPassReverse /idp <a href="http://localhost:8080/idp">http://localhost:8080/idp</a><br>
<br>
</VirtualHost><br>
<br>
Jetty configuration file<br>
[Unit]<br>
Description=Jetty Web Server<br>
After=network.target<br>
<br>
[Service]<br>
User=jetty<br>
ExecStart=/usr/bin/java -jar /opt/jetty/start.jar jetty.http.port=8080 jetty.ssl.port=8443 --module=deploy,http,jsp,jstl,websocket,ext,resources<br>
WorkingDirectory=/opt/jetty-base<br>
Environment=JETTY_HOME=/opt/jetty<br>
Environment=JETTY_BASE=/opt/jetty-base<br>
Restart=on-failure<br>
<br>
StandardOutput=append:/var/log/jetty/jetty.log<br>
StandardError=append:/var/log/jetty/jetty_error.log<br>
<br>
[Install]<br>
WantedBy=multi-user.target<br>
<br>
I have already checked the IdP metadata, and all the endpoints are using HTTPS. What could I do in this case? Thank you!<br clear="all">
<br>
<span class="gmail_signature_prefix">-- </span><br>
<div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">
<div dir="ltr"><i><b>Luan Trindade</b></i><br>
</div>
</div>
</div>
<span>-- </span><br>
<span>For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw</span><br>
<span>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</span><br>
</div>
</blockquote>
</body>
</html>