Apache ServerName, handlerURL, and Reverse Proxy

[Martin Haase]

Hi List,
we have a reverse proxy scenario with SP 2.5.1. For several reasons, we 
cannot set Apache's ServerName to the proxy's name, but must leave it on 
the target's name. Given that, it seems we have two choices:
a) leave handlerURL the default /Shibboleth.sso. This creates wrong ACS 
URL for the IdP, leading directly to the target without passing the 
proxy, which is unwanted
b) set handlerURL to http(s)://proxy/Shibboleth.sso. This creates the 
right ACS URL for the IdP, however mod_shib does not seem to get active 
when accessed in the vhost on http(s)://target/Shibboleth.sso. Message: 
/Shibboleth.sso/SAML/POST not found etc.
I know this has been asked previously, and also by myself, but isn't it 
possible to specify two handler locations, one where mod_shib actually 
listens, and one for outside access i.e. for the IdP? ServerName 
actually fulfills two functions which should be separated: telling 
Apache which vhost to use (and mod_shib on which handler to listen), and 
for generation of self-referential URLs (used by shibd). For the latter, 
I suggest to introduce a new feature in the SP configuration.
Regards,
Martin