SP behind VPN Gateway: handler locations

[Martin Haase]

Hi Team Great,

I have a question on how to configure the protocol handlers of an SP
sitting in an intranet for communication with an outside IdP where a VPN
Gateway does URL rewriting.

Normally the HTTP-POST Assertion Consumer would be at:

    https://sp1.intra.net/Shibboleth.sso/SAML2/POST

This is o.k. for users in the intranet. Now the VPN gateway does URL
rewriting such that for outside users, the SP's ACS URL would be:

   
https://my.vpngateway.net/Shibboleth.sso/SAML2/POST/,DanaInfo=sp1.intra.net,SSL

(This Juniper appliance *could* also do a true VPN bridge, but
presumably policy forbids Shib users to have full network access to the
intranet. Hence this URL rewriting interception thing.)

Now I configured this URL in the SP's metadata on the IdP side. The
problem is, the SP sends the above intranet URL as its ACS. Both do not
match, so the IdP complains that there's no peer endpoint available etc.
So how could I achieve that the SP is sending to the IdP the gateway
address as its ACS, whereas actually receiving the assertion on its
usual address?

Here's my set-up:
http://www.daasi.de/shib/shibToJuniperWithApplication.png and it is step
4 I'm concerned about.

Thanx in advance,
Martin

-- 
-----------------------------------------------------------------------
Dr. Martin Haase
DAASI International GmbH                   phone:     +49 7071 407109-6
Europaplatz 3                              Fax  :     +49 7071 407109-9
D-72072 Tübingen                           email: Martin.Haase at DAASI.de
Germany                                    Web  :   http://www.daasi.de

Directory Applications for Advanced Security and Information Management
-----------------------------------------------------------------------


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3765 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20110825/1243aa44/attachment-0001.bin