IDP Reverse Proxy

[Cantor, Scott]

On 7/24/12 1:55 PM, "Joshua Riffle" <jriffle at apu.edu> wrote:
>
>Under normal circumstances we use SSL encryption at the front-facing
>server and clear text communication to the proxied host because it's
>already in a safe sandbox but even with
>ProxyPreserveHost turned on Shib recognizes that the endpoint URL is HTTP
>when it arrives at shib.example.edu <http://shib.example.edu> and not
>HTTPS which it expects (causing a SAML EndPoint URL mismatch). So it was
>necessary to setup SSL communication between the front-facing server and
>its proxied host in order to mimic the HTTPS URL and match the expected
>EndPoint URL for SAML.

That's what happens when you *don't* virtualize and instead use a
rewriting proxy. If you want it to work as intended, you have to
virtualize the back end. See ServerName in the Apache documentation
amongst the other related commands.

-- Scott