Apache ServerName, handlerURL, and Reverse Proxy

[Cantor, Scott]

On 1/9/13 10:50 AM, "Martin Haase" <martin.haase at daasi.de> wrote:

>b) set handlerURL to http(s)://proxy/Shibboleth.sso. This creates the
>right ACS URL for the IdP, however mod_shib does not seem to get active
>when accessed in the vhost on http(s)://target/Shibboleth.sso. Message:
>/Shibboleth.sso/SAML/POST not found etc.

Apache runs the handler no matter what, but when it computes the request
URL, Apache is telling the module the request is to target, not proxy.
That's not the handlerURL you told it about, ergo it ignores the request.

Even if "target" is used by the client, that could resolve to the proxy
address, if you want to keep the name "target". Internally on the network,
it might resolve to something else, but externally, to the proxy.

>I know this has been asked previously, and also by myself, but isn't it
>possible to specify two handler locations, one where mod_shib actually
>listens, and one for outside access i.e. for the IdP?

No, that's what virtualization features in the server is for. I'm not
going to reimplement them.

> ServerName 
>actually fulfills two functions which should be separated: telling
>Apache which vhost to use (and mod_shib on which handler to listen), and
>for generation of self-referential URLs (used by shibd). For the latter,
>I suggest to introduce a new feature in the SP configuration.

Apache provides ServerName for exactly the purpose of computing the
requested (and thus) self-referential URLs. That's what I'm going to use.
I'm not going to create the same mess IIS causes.

You might be able to cook something up using a separate vhost and maybe
some mod_rewrite rules, but that's beyond my capability.

-- Scott