SP behind VPN Gateway: handler locations

[Cantor, Scott]

On 8/31/11 5:41 AM, "Martin Haase" <martin.haase at daasi.de> wrote:

>Hi Peter, hi Scott,
>
>thanks for your answers. It took me some time as we had a longer server
>outage. I now brought the IdP past the ACS check, but differently than
>Peter suggested. I just added to the SP's metadata at the IdP:
>
>    <md:ACS...
>Location="https://my.vpngateway.net/Shibboleth.sso/SAML2/POST/,DanaInfo=sp
>1.intra.net,SSL"
>ResponseLocation="https://sp1.intra.net/Shibboleth.sso/SAML2/POST" />
>
>This makes the IdP select and check for the intranet ACS URL but
>redirect the message to the gateway's address.

That would be a bug. The check has to be against the location actually
used, and when you set a ResponseLocation, the Location should simply be
ignored. Please file a bug on that.

>Can this check be switched off?

No.

>    ad 1. I cannot seem to be able to set the SP's server address to the
>gateway's address,

You need a proper vhost for it.

>    ad 3. how can I make the IdP redirect to a different URL than the
>destination encoded in the SAML response?

You can't.

>Tried setting
>ResponseLocation for the ACS handler as well, which was ignored.

I didn't say to do that, I said to add the suffix to the Location. The
rest has to come from your web server. You MUST virtualize it. There is no
other option.

>Do you still have any ideas?

Please re-read my original message and do what I suggested there.

-- Scott