Configuring Shibboleth Metadata File

1
votes

We have recently migrated to a new hosting environment so have installed a fresh instance of Shibboleth. When we generate sp metadata files, the urls are non-secure (ie http) even though the url used to generate the metadata uses https.

When using the test connection from our own Azure AD system, we see the obvious error: "The reply URL specified in the request does not match the reply URLs configured for the application:"

I have limited knowledge of configuring the system beyond working on shibboleth2.xml and attribute-map.xml so would be very grateful if anyone can point me in the right direction to fix this.

1
metadatashibboleth

1 Answers

0
votes

I'm not sure if you managed to configure it but i'm currently working on this as well, and i think i can help. So the ReplyURL you need to provide in the Azure Portal, is the reply URL that accepts the authentiaction reply message from the identity provider.

In the case of Shibboleth it is:

http[s]://yoursitename/Shibboleth.SSO/Auth/Saml

So if your webpage is for instance:

https://localhost/Foo

The replyURL should be:

https://localhost/Shibboleth.SSO/Auth/Saml

Notice that the page "Foo" is not in the replyURL. After the authentication the browser should send the IDP reply to https://localhost/Shibboleth.SSO/Auth/Saml, after which Shibboleth should redirect you back to https://localhost/Foo

At least that's the default behaviour.