IDP Reverse Proxy

[Kevin P. Foote]

You will find your answers in any of the numerous threads on "load balancing" your IdP found in the list archives



Joshua Riffle <jriffle at apu.edu> wrote:

>Hi Scott,
>  Could you clarify what you mean by "virtualize"? Also, is there any
>existing wiki documentation for successful implementation of Shibboleth IDP
>and Reverse Proxy (I have yet to find any)?  I read through Apache
>documentation for the ServerName directive and I see that you can specify
>the schema (HTTPS) and then it should get passed on the the ProxyPass
>argument with the correct URL rather than needing to setup SSL
>communication between the front-facing and back-end servers though I don't
>mind keeping the extra layer of secure communications as it is now. I don't
>wish to be frustrating to you but I would love to have a good grasp on best
>practices for our instance of Shibboleth so I'm looking forward to any
>advice from you.
>
>Joshua Riffle
>Software Engineer
>*Azusa Pacific University*
>
>On Tue, Jul 24, 2012 at 1:06 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On 7/24/12 1:55 PM, "Joshua Riffle" <jriffle at apu.edu> wrote:
>> >
>> >Under normal circumstances we use SSL encryption at the front-facing
>> >server and clear text communication to the proxied host because it's
>> >already in a safe sandbox but even with
>> >ProxyPreserveHost turned on Shib recognizes that the endpoint URL is HTTP
>> >when it arrives at shib.example.edu <http://shib.example.edu> and not
>> >HTTPS which it expects (causing a SAML EndPoint URL mismatch). So it was
>> >necessary to setup SSL communication between the front-facing server and
>> >its proxied host in order to mimic the HTTPS URL and match the expected
>> >EndPoint URL for SAML.
>>
>> That's what happens when you *don't* virtualize and instead use a
>> rewriting proxy. If you want it to work as intended, you have to
>> virtualize the back end. See ServerName in the Apache documentation
>> amongst the other related commands.
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>--
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120725/fcf20e84/attachment.html