When SAML authentication is enabled Projeqtor tries to automaticaly generate the SAML SP entityid and SAML endpoints URL based on values from the $_SERVER array (getBaseUrl() in model/persitence/SqlElement.php)
Currently this function doesn't check standard variables set by common reverse proxy (eg. X_FORWARDED_PROTO). When the reverse proxy is doing SSL termination (HTTPS between the browser and the reverse proxy, HTTP between the reverse proxy and the Projeqtor server). This is often the case for cloud/kubernetes deployment.
Projeqtor generates SAML endpoints URL with http prefix instead of https prefix. This behaviour generates browser warnings because of the security context switch.
The following solves the problem (in getBaseUrl() in model/persitence/SqlElement.php):
$https=(isset($_SERVER['HTTPS']) || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https'))?'on':'off';
Maybe a configuration setting is better suited
Regards
Hi,
Thnaks for pointing out the issue.
Your proposale is weird and won't work on our Dev environments.
We added possibility to define parameter
if (Parameter::getGlobalParameter('paramHttps')!='') $https=Parameter::getGlobalParameter('paramHttps');
So you just have to add in your parameters.php file
$paramHttps='on';
Fix will be deployed on V9.4.0
Works great on 9.4.2, thanks