IDP Reverse Proxy

[Joshua Riffle]

Hi Scott,
  Could you clarify what you mean by "virtualize"? Also, is there any
existing wiki documentation for successful implementation of Shibboleth IDP
and Reverse Proxy (I have yet to find any)?  I read through Apache
documentation for the ServerName directive and I see that you can specify
the schema (HTTPS) and then it should get passed on the the ProxyPass
argument with the correct URL rather than needing to setup SSL
communication between the front-facing and back-end servers though I don't
mind keeping the extra layer of secure communications as it is now. I don't
wish to be frustrating to you but I would love to have a good grasp on best
practices for our instance of Shibboleth so I'm looking forward to any
advice from you.

Joshua Riffle
Software Engineer
*Azusa Pacific University*

On Tue, Jul 24, 2012 at 1:06 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/24/12 1:55 PM, "Joshua Riffle" <jriffle at apu.edu> wrote:
> >
> >Under normal circumstances we use SSL encryption at the front-facing
> >server and clear text communication to the proxied host because it's
> >already in a safe sandbox but even with
> >ProxyPreserveHost turned on Shib recognizes that the endpoint URL is HTTP
> >when it arrives at shib.example.edu <http://shib.example.edu> and not
> >HTTPS which it expects (causing a SAML EndPoint URL mismatch). So it was
> >necessary to setup SSL communication between the front-facing server and
> >its proxied host in order to mimic the HTTPS URL and match the expected
> >EndPoint URL for SAML.
>
> That's what happens when you *don't* virtualize and instead use a
> rewriting proxy. If you want it to work as intended, you have to
> virtualize the back end. See ServerName in the Apache documentation
> amongst the other related commands.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120725/b0ee844f/attachment.html