title: SAML and forced SSL
body: <p>I'm implementing SAML support on my site. I'm using <a href="https://github.com/onelogin/python-saml" rel="nofollow">OneLogin's Python SAML Toolkit</a> in my Django app to do this. Everything works fine connecting to both a OneLogin test app and an Azure app when it's with my local machine, either <a href="http://127.0.0.1:8000" rel="nofollow">http://127.0.0.1:8000</a> (completely local) or <a href="http://192.168.x.x:800" rel="nofollow">http://192.168.x.x:800</a> (local network). As soon as I try this on my staging server, which forces all URLs to https, things fail. IE11 fails to POST any data at all in the identity provider's response, which is weird, and generally I get errors from the Toolkit like so:</p>
  
  <pre><code>The response was received at https://dev.mysite.com:80/saml/connect/ instead of https://dev.mysite.com/saml/connect/
  </code></pre>
  
  <p>So while things should be configured properly, the IdP winds up trying to POST back to my staging server on port 80, which confuses things. If I set it all up to use port 80 from the start, Chrome freaks out because it doesn't trust <a href="https://...:80" rel="nofollow">https://...:80</a> as secure. I can't find any docs or SO questions referencing this issue; all I've seen is this note in <a href="https://developers.onelogin.com/saml/python" rel="nofollow">the OneLogin Python setup instructions</a>:</p>
  
  <pre><code>Important: Ensure that your URLs begin with http, not https.
  </code></pre>
  
  <p>but there's no explanation as to WHY. I am thoroughly confused.</p>