diff --git a/README.rst b/README.rst
index 3fde09f..bf5ceeb 100644
--- a/README.rst
+++ b/README.rst
@@ -321,6 +321,7 @@
           federation_driver: keystone.contrib.federation.backends.sql.Federation
           trusted_dashboard:
             - http://${_param:proxy_vip_address_public}/horizon/auth/websso/
+          shib_url_scheme: https
     apache:
       server:
         pkgs:
diff --git a/keystone/files/mitaka/wsgi-keystone.conf b/keystone/files/mitaka/wsgi-keystone.conf
index 74a1c30..763672d 100644
--- a/keystone/files/mitaka/wsgi-keystone.conf
+++ b/keystone/files/mitaka/wsgi-keystone.conf
@@ -30,6 +30,9 @@
     </Directory>
 
     {% if server.websso is defined %}
+    {% if server.websso.shib_url_scheme is defined %}
+    ShibURLScheme {{ server.websso.shib_url_scheme }}
+    {%- endif %}
     WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /usr/bin/keystone-wsgi-public/$1
     <Location /Shibboleth.sso>
       SetHandler shib
@@ -83,6 +86,9 @@
     </Directory>
 
     {% if server.websso is defined %}
+    {% if server.websso.shib_url_scheme is defined %}
+    ShibURLScheme {{ server.websso.shib_url_scheme }}
+    {%- endif %}
     WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /usr/bin/keystone-wsgi-admin/$1
     <Location /Shibboleth.sso>
       SetHandler shib