PeopleSoft/WebLogic proxy with Shibboleth Native SP and Apache

[Cantor, Scott]

On 1/23/13 2:09 PM, "Marc Boorshtein" <mboorshtein at gmail.com> wrote:

>While I'm not working at a university that has implemented these
>technologies I have implemented reverse proxies for authentication and
>weblogic on several occasions and I would NOT only protect the login
>page but the entire application.  The reason is that if you only
>protect the login page and not weblogic someone could spoof their
>login by injecting a header.  Better to use the reverse proxy to cover
>everything to guard against that.

That won't protect you. If you're talking about the headers the SP is
handling, then sure, but by definition you aren't, since you're assuming
that one could omit the application from it. So assuming you mean a custom
header the application is relying on, that would be a bug in the
application to assume such a header were meaningful.

The connector that WebLogic provides for Apache automatically proxies all
headers the client sends to WebLogic, so anything spoofed would get there
anyway.

Note that you have a general point, which is that it's asking for security
issues to selectively do this anyway, for other reasons. But this would be
a more specific flaw that would bite you regardless.

-- Scott