title: Spring saml redirects the request to http
body: <p>I am using the spring saml extension with Apache 2.2 + Tomcat 7.0 + OKTA(IdP). The securityContext.xml looks as follows:</p>
  
  <p>MetadataGeneratorFilter:</p>
  
  <pre><code>&lt;bean id="metadataGeneratorFilter" class="org.springframework.security.saml.metadata.MetadataGeneratorFilter"&gt;
      &lt;constructor-arg&gt;
          &lt;bean class="org.springframework.security.saml.metadata.MetadataGenerator"&gt;
              &lt;property name="entityBaseURL" value="https://myapp.com/api"/&gt;
          &lt;/bean&gt;
      &lt;/constructor-arg&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>ContextProvider:</p>
  
  <pre><code>&lt;bean id="contextProvider" class="org.springframework.security.saml.context.SAMLContextProviderLB"&gt;
      &lt;property name="scheme" value="https"/&gt;
      &lt;property name="serverName" value="myapp.com"/&gt;
      &lt;property name="serverPort" value="443"/&gt;
      &lt;property name="includeServerPortInRequestURL" value="false"/&gt;
      &lt;property name="contextPath" value="/api"/&gt;
      &lt;property name="storageFactory"&gt;
          &lt;bean class="org.springframework.security.saml.storage.EmptyStorageFactory"/&gt;
      &lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>I use the following URL which triggers the SP initiated login.</p>
  
  <pre><code>https://myapp.com/api/welcome.html
  </code></pre>
  
  <p>After authentication is complete, the browser gets redirected to HTTP instead of HTTPS.</p>
  
  <pre><code> http://myapp.com/api/welcome.html
  </code></pre>
  
  <p>I don't know why the request gets redirected to HTTP. Please help.</p>
  
  <p>Thanks</p>
  
  <p>Nara</p>
  
  <p>HTTP Requests Dump:</p>
  
  <p><a href="https://docs.google.com/document/d/1mYh-EhDjxMixzZ8krhOg_2fjpTaTu7fuST_nIXAMeVY/edit?usp=sharing" rel="nofollow">https://docs.google.com/document/d/1mYh-EhDjxMixzZ8krhOg_2fjpTaTu7fuST_nIXAMeVY/edit?usp=sharing</a></p>
  
  <p>In OKTA, created a SAML 2.0 app with following metadata:</p>
  
  <pre>
  
      Single Sign On URL => https://myapp.com/api/saml/SSO
      Recipient URL => https://myapp.com/api/saml/SSO
      Destination URL => https://myapp.com/api/saml/SSO
      Audience Restriction => https://myapp.com/api/saml/metadata
      Default Relay State => https://myapp.com/dashboard.html
      Name ID Format => Unspecified
      Response => Signed
      Assertion Signature => Signed
      Signature Algorithm => RSA_SHA256
      Digest Algorithm => SHA256
      Assertion Encryption => Unencrypted
      SAML Single Logout => Disabled
      authnContextClassRef => PasswordProtectedTransport
      Request Compression => Uncompressed
      Honor Force Authentication => Yes
      SAML Issuer ID => http://www.okta.com/${org.externalKey}
  
  </pre>
  
  <p>Spring Config:</p>
  
  <pre>
  https://docs.google.com/document/d/16iDLcBuwvQ23-mKMFybPfxdIyvqCBi5sbYePgUjl0p4/edit?usp=sharing
  </pre>