Apache ServerName, handlerURL, and Reverse Proxy

[Christopher Bongaarts]

On 1/9/2013 9:50 AM, Martin Haase wrote:
> Hi List,
> we have a reverse proxy scenario with SP 2.5.1. For several reasons, we
> cannot set Apache's ServerName to the proxy's name, but must leave it on
> the target's name. Given that, it seems we have two choices:
> a) leave handlerURL the default /Shibboleth.sso. This creates wrong ACS
> URL for the IdP, leading directly to the target without passing the
> proxy, which is unwanted
> b) set handlerURL to http(s)://proxy/Shibboleth.sso. This creates the
> right ACS URL for the IdP, however mod_shib does not seem to get active
> when accessed in the vhost on http(s)://target/Shibboleth.sso. Message:
> /Shibboleth.sso/SAML/POST not found etc.
> I know this has been asked previously, and also by myself, but isn't it
> possible to specify two handler locations, one where mod_shib actually
> listens, and one for outside access i.e. for the IdP? ServerName
> actually fulfills two functions which should be separated: telling
> Apache which vhost to use (and mod_shib on which handler to listen), and
> for generation of self-referential URLs (used by shibd). For the latter,
> I suggest to introduce a new feature in the SP configuration.

Or just fix your reverse proxy so it sends the proper (virtualized) 
Host: headers, so you can set ServerName properly (to the virtualized form).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%