The SP metadata can by retrieved by doing a GET on the SP metadata URL which is:

$SP/$MellonEndpointPath/metadata

where

SP = the FQDN of the SP

MellonEndpointPath = the value of the MellonEndpointPath configuration item (defaults to 'mellon' but is set to 'saml2' by the ipsilon client.

The problem is the function am_generate_metadata() in auth_mellon_handler.c uses the request URL to get the scheme and host (calls ap_construct_url()). The $SP/$MellonEndpointPath/metadata URL can be invoked with either HTTP or HTTPS as the scheme. Thus if you use http://$SP/$MellonEndpointPath/metadata to get the SP's metadata it will not have the correct binding endpoints in the metadata because they will use http instead of https as is required by SAML, this causes various metadata failures.

We need to either document this problem, make sure the ipsilon client always does the right thing or get an upstream fix.

This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.