title: Failure when Simplesamlphp is behind load balancer
body: <p>We use <a href="https://simplesamlphp.org/docs/stable/simplesamlphp-sp" rel="nofollow noreferrer">simplesamlphp</a> as a service provider. We've integrated with a number of Idp's.  Everything works fine.</p>
  <p>Now we want to change our server architecture to <code>load balancer -&gt; webserver -&gt; database server</code>.  The problem comes up when we put the <code>load balancer</code> in front of the <code>webserver</code>. The idp's get an error.</p>
  <p>The <code>load balancer</code> terminates <code>https</code>, which I believe is where the problem is happening.  So when the <code>load balancer</code> sends the request to the <code>webserver</code> it is a regular <code>http</code> request.</p>
  <p>When I log the initial happenings I get</p>
  <p>I'm gonna simplify the <code>xml</code> a bit and put the parts that were different</p>
  <p>with <code>load balancer</code></p>
  <pre><code>Session: 'idp-name' not valid because we are not authenticated.
  Saved state: '_somelongstringofnumbersandletters'
  Sending SAML 2 AuthnRequest to '{{their info}}'
  Sending message:
      &lt;samlp:AuthnRequest ... AssertionConsumerServiceURL=&quot;http://{{our-info}}&quot;&gt;
          &lt;saml:Issuer&gt;http://{{our-info}}&lt;/saml:Issuer&gt;
          &lt;samlp:NameIDPolicy Format=&quot;urn:oasis:names:tc:SAML:2.0:nameid-format:transient&quot; AllowCreate=&quot;true&quot;/&gt;
      &lt;/samlp:AuthnRequest&gt;
  </code></pre>
  <p>So above the only parts that are different between pointing to <code>load balancer</code> and <code>webserver</code> is the <code>http</code> and <code>https</code>, respectively.</p>
  <p>Wasn't sure if there was a way to have <code>simplesamlphp</code> just return <code>https</code>. Or will it always check the current state of the request and assume <code>http</code>.</p>
  <p>Just to make sure I'm giving all the data.  The process is initialized by the SP. So they just go to a url like <a href="https://oursite.com/idp-name" rel="nofollow noreferrer">https://oursite.com/idp-name</a>.  And we are always using <code>https</code>.</p>
  <p>Let me know if I need to clarify something.</p>
  <h1>UPDATE</h1>
  <p>We solved the problem by <strong>NOT</strong> terminating the HTTPS request at the load balancer, and allowing the request to pass through to the servers.  So our SSL certificates are directly on our Web servers and not the load balancer.</p>
  <p>I couldn't get the solution given to work, but that could just be my own fault.  We needed a solution quick, and not decrypting SSL on the load balancer was the easiest way.</p>