Using a "reverse proxy" based authentication with shibboleth

[Viitanen Viljo]

Hey all,

In hope of someone else finding this useful, I'll post my solution to a problem that was not completely straightforward to solve.

We're migrating from shibboleth built-in ldap authentication to a reverse proxy based authentication solution, which allows custom headers to be injected in the request for the back end server which back end servers are supposed to trust. The problem was to get apache or shibboleth accept the custom header that contains the username.

The solution was apache's built in http://httpd.apache.org/docs/2.2/mod/mod_authn_anon.html which accepts any password from a basic auth header. The reverse proxy was configured to inject a basic auth header with a static password for all users. We combined this with a shared secret and of course https connections from reverse proxy to shibboleth server. Shared secret is another custom header, and is validated with apache config. Like so:

<Location /idp/Authn/RemoteUser>
  SSLRequireSSL
  AuthType Basic
  AuthName "Restricted"
  AuthBasicProvider anon
  Anonymous anonymous *
  Require valid-user
  SetEnvIfNoCase X-Shared-Secret "open sesame" ok
  order deny,allow
  deny from all
  allow from env=ok
</Location>

--
Viljo Viitanen
University of Jyväskylä

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120308/069475e8/attachment.html