IDP Reverse Proxy

[Cantor, Scott]

On 7/23/12 3:52 PM, "Joshua Riffle" <jriffle at apu.edu> wrote:

>  When the front-facing proxy receives a message on URL at
>idp.example.edu <http://idp.example.edu> (SSL Certificate) it rewrites
>the URL to communicate with the back-end Shibboleth server to
>shib.example.edu <http://shib.example.edu>. This breaks the SAML
>implementation which (like you said) requires that the URL that receives
>the message also matches the SAML EndPoint Location.

Then your web server isn't configured properly and you just need to fix
it. You need to virtualize it to issue redirects and compute URLs as
idp.example.edu. That's standard.

> The original question is whether or not there is a way
> of managing this problem via SAML configuration, a hack or something
>more elegant.

The latter. Standard host virtualization.

-- Scott