[SOLVED] Re: Apache ServerName, handlerURL, and Reverse Proxy

[Martin Haase]

Hi Christopher, hi Scott and Peter,

thank you for your responses, highly appreciated. As it was the only
option, we ceased from using name-based vhosts. But we didn't have more
IP addresses at our disposal, so we decided to use different ports for
separating the vhosts from each other. Additionally we added the option
"ProxyPreserveHost On" to the Apache reverse proxy in order for
front-channel logout to work. The latter option is not described on
https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy, and
I could add it - do you feel that makes sense?

Regards,
Martin



Am 09.01.2013 17:28, schrieb Christopher Bongaarts:
> On 1/9/2013 10:19 AM, Martin Haase wrote:
>> Am 09.01.2013 17:09, schrieb Christopher Bongaarts:
>>> Or just fix your reverse proxy so it sends the proper (virtualized)
>>> Host: headers, so you can set ServerName properly (to the virtualized
>>> form).
>> That's not an option: It is set that we have proxy.extern/aaa proxying
>> to aaa.target.intern, proxy.extern/bbb to bbb.target.intern etc., with
>> many such target vhosts.
> Ah, they're all named-based vhosts on the same apache instance.
>
> Another alternative:  since the targets are not supposed to be accessed 
> from the outside, give them separate private IP addresses and use 
> IP-based vhosts instead.
>
> It seems like it might be reasonable to file a bug with the Apache folks 
> asking for a way to configure Host: routing for name-based vhosts 
> separately from redirect generation.
>
> (Of course, if there is an easy way for Shib to work around it in the 
> meantime, that might be reasonable too...)

-- 
-----------------------------------------------------------------------
Dr. Martin Haase
DAASI International GmbH                   phone:     +49 7071 407109-6
Europaplatz 3                              Fax  :     +49 7071 407109-9
D-72072 Tübingen                           email: Martin.Haase at DAASI.de
Germany                                    Web  :   http://www.daasi.de

Directory Applications for Advanced Security and Information Management
-----------------------------------------------------------------------


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2345 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20130114/e456de82/attachment.bin