Workflow Manager - Failed to query the Oauth S2S metadata endpoint

Eu configurei esses dias um novo ambiente para desenvolver fluxos de trabalho e encontrei um comportamento interessante. 

Observação: Eu entendo abaixo como workaround e não recomendo a seguir esses passos em um ambiente de produção.

O cenário é seguinte: Web Application configurado para utilizar http e o Workflow Manager (WFM) para não aceitar conexões http.

1. Registrando o WFM no SharePoint resulta em seguinte evento no Powershell:

Register-SPWorkflowService -SPSite "http://sp2013dev/" -WorkflowHostUri "https://sp2013dev.contoso.com:12290" -force

Register-SPWorkflowService : Failed to query the OAuth S2S metadata endpoint

at URI 'http://sp2013dev/_layouts/15/metadata/json/1'. Error details: 'The

metadata endpoint responded with an error. HTTP status code: Forbidden.'. HTTP

headers received from the server - ActivityId:

d5911e15-e529-469b-887a-24629551f543. NodeId: SP2013DEV. Scope: /SharePoint.

Client ActivityId : 3b09edcf-2fee-4ea8-98b0-699c58fba14e.

At line:1 char:1

+ Register-SPWorkflowService -SPSite "http://sp2013dev/" -WorkflowHostUri

"https:/ ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~

    + CategoryInfo          : InvalidData: (Microsoft.Share...WorkflowService:

   RegisterSPWorkflowService) [Register-SPWorkflowService], InvalidRequestExc

  eption

    + FullyQualifiedErrorId : Microsoft.SharePoint.WorkflowServices.PowerShell

   .RegisterSPWorkflowService

Nos logs do SharePoint o seguinte evento:

02/13/2014 05:30:41.01   PowerShell.exe (0x17E0)          0x002C       SharePoint Foundation  PowerShell  6tf2   High         Microsoft.Workflow.Client.InvalidRequestException: Failed to query the OAuth S2S metadata endpoint at URI 'http://sp2013dev/_layouts/15/metadata/json/1'. Error details: 'The metadata endpoint responded with an error. HTTP status code: Forbidden.'. HTTP headers received from the server - ActivityId: 71ac11da-2767-4d34-b9fd-0537e08c0bf0. NodeId: SP2013DEV. Scope: /SharePoint. Client ActivityId : 05cdfb77-c6c3-4526-9686-1e09bf084eee. ---> System.Net.WebException: The remote server returned an error: (400) Bad Request.     at Microsoft.Workflow.Common.AsyncResult.End[TAsyncResult](IAsyncResult result)     at Microsoft.Workflow.Client.HttpGetResponseAsyncResult`1.End(IAsyncResult result)     at Microsoft.Workflow.Client.ClientHelpers.SendRequest[T](HttpWebRequest request, T content)     --- End of inner exception stack trace ---     at Microsoft.Workflow.Client.ClientHelpers.SendRequest[T](HttpWebRequest request, T content)     at Microsoft.Workflow.Client.WorkflowManagementClient.SendRequest[T](HttpWebRequest request, T content)     at Microsoft.Workflow.Client.ScopeManager.PublishScopeInternal(ScopeDescription description, String[] pathSegments)     at Microsoft.SharePoint.WorkflowServices.WorkflowServerPairingContext.EnsureFarmScope(Boolean configureOAuth)     at Microsoft.SharePoint.WorkflowServices.PowerShell.RegisterSPWorkflowService.InternalProcessRecord()     at Microsoft.SharePoint.PowerShell.SPCmdlet.ProcessRecord()    05cdfb77-c6c3-4526-9686-1e09bf084eee

Todos os eventos indicaram problemas no acesso do endpoint "http://sp2013dev/_layouts/15/metadata/json/1" e realmente o acesso na pagina utilizando o navegador  resultou em 403 (forbidden).

Eu executei o mesmo comando com o parâmetro -AllowOAuthHttp com sucesso, sem problemas no endpoint, conforme abaixo:

Eu removi em seguida o Workflow Service Application com o comando Get-SPWorkflowServiceApplicationProxy | Remove-SPServiceApplicationProxy para reproduzir o problema novamente.

E desta vez consegui registar o WFM sem o parametro -AllowOAuthHttp....

PS C:\Users\administrator.CONTOSO> Get-SPWorkflowServiceApplicationProxy | Remove-SPServiceApplicationProxy

Confirm

Are you sure you want to perform this action?

Performing operation "Remove-SPServiceApplicationProxy" on Target

"WorkflowServiceApplicationProxy Name=Workflow Service Application Proxy".

[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help

(default is "Y"):y

PS C:\Users\administrator.CONTOSO> Register-SPWorkflowService -SPSite "http://sp2013dev/" -WorkflowHostUri "https://sp2013dev.contoso.com:12290" -force

WARNING: Overwriting existing scope named "SharePoint" in the workflow server.

 If another SharePoint farm was registered using this scope, that farm may not

be able to continue working with the workflow server unless re-registered under

 another scope name.

PS C:\Users\administrator.CONTOSO>

Install and configure workflow for SharePoint Server 2013

[]