title: PingAccess issues with proxying target sites with HTTP/HTTPS mix
body: <p>I'm trying to get PingAccess set up as a proxy (let's call the PA host 
  <code>pagateway</code>) for a couple of applications that share a Web Session. I want all access to come via the PA pagateway and use HTTPS, but the back end systems are not HTTPS.</p>
  
  <p>I have two sites defined, <code>app1:8080</code> and <code>app2:8080</code>. Both are set to "secure" = no and "use target host header" = yes.</p>
  
  <p>I have listeners defined on ports 5000 and 5001 that are both set to "secure" = yes.</p>
  
  <p>The first problem I found is that when I access either app in this way (e.g. going to <code>https://pagateway:5000</code>), after successfully authenticating with PingFederate I end up getting redirected to the actual underlying host name (e.g. <code>http://app1:8080</code>), meaning any subsequent interactions with the app are not via PingAccess. For users outside the network they wouldn't even be able to do that because the <code>app1</code> host wouldn't even be visible or accessible.</p>
  
  <p>I thought maybe I needed to turn off "Use target host header" to false but Chrome prompts me to download a file that contains NAK, ETX, ETX, NUL, STX, STX codes, and in the PA logs I get an SSL error:</p>
  
  <pre><code>2015-11-20 11:13:33,718 DEBUG [6a5KYac2dnnY0ZpIl-3GNA] com.pingidentity.pa.core.transport.http.HttpServerHandler:180 - IOException reading sourceSocket
      javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
      at sun.security.ssl.InputRecord.handleUnknownRecord(InputRecord.java:710)
      ...
  </code></pre>
  
  <p>I'm unsure exactly which part of the process the SSL error is coming from (between browser and <code>pagateway</code>, or <code>pagateway</code> and <code>app1</code>). I'm guessing maybe <code>app1</code> is having trouble with the unexpected host header...</p>
  
  <p>In another variation I turned off SSL on the PA listener (I also had to change the PingAccess call-back URL in the PingFederate client settings to be http). But when I accessed it via <code>http://pagateway:5000</code> I got a generic PingFederate error message in the browser and a different error in the PA logs:</p>
  
  <pre><code>2015-11-20 11:37:25,764 DEBUG [DBxHnFjViCgLYgYb-IrfqQ] com.pingidentity.pa.core.interceptor.flow.InterceptorFlowController:148 - Invoking request handler: Scheme Validation for Request to [pagateway:5000] [/]
  2015-11-20 11:37:25,764 DEBUG [DBxHnFjViCgLYgYb-IrfqQ] com.pingidentity.pa.core.interceptor.flow.InterceptorFlowController:200 - Exception caught.  Invoking abort handlers
  com.pingidentity.pa.sdk.policy.AccessException: Invalid request protocol.
      at com.pingidentity.pa.core.interceptor.SchemeValidationInterceptor.handleRequest(SchemeValidationInterceptor.java:61)
  </code></pre>
  
  <p>Does anyone have any idea what I'm doing wrong? I'm kind of surprised about the redirection to the actual server name, to be honest, but after that I'm stumped about where to go from here.</p>
  
  <p>Any help would be appreciated.</p>