Using Shibboleth SP in front of an application server

[Ken Weiss]

SOLVED.

This does not work:

    RewriteEngine On
    RewriteLog logs/dmp2-dev.cdlib.org-rewriteLog
    RewriteLogLevel 0
    RewriteCond %{REQUEST_URI} !/cgi-bin/
    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_URI} !-f
    RewriteCond %{REQUEST_URI} !/Shibboleth.sso/Session
    RewriteCond %{REQUEST_URI} !/Shibboleth.sso/Status
    RewriteCond %{REQUEST_URI} !/Shibboleth.sso/Metadata
    RewriteRule ^/(.*)$ balancer://dmp2-dev_cluster%{REQUEST_URI} [P,QSA,L]

This does:

    RewriteEngine On
    RewriteLog logs/dmp2-dev.cdlib.org-rewriteLog
    RewriteLogLevel 0
    RewriteCond %{REQUEST_URI} !/cgi-bin/
    RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_URI} !-f
    RewriteCond %{REQUEST_URI} !/Shibboleth.sso
RewriteRule ^/(.*)$ balancer://dmp2-dev_cluster%{REQUEST_URI} [P,QSA,L]


I failed to exclude all /Shibboleth.sso/... URLs from the rewrite rule,
resulting in the return package from the IDP getting handed to the
Ruby/Rails application instead of shibd. I knew it was something simple.
Thanks, Brian Tingle!


--Ken




------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612






On 6/26/13 4:01 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:

>Hi, 
>
>I am trying to get the following configuration to work:
>
>https://example.cdlib.org has an Apache server that sends all requests
>from port 443 to http://example.cdlib.org:20225. There is a Ruby/Rails
>application that listens at port 20225.
>
>I want to install a Shibboleth SP on example.cdlib.org so that all users
>coming to port 443 are first authenticated at the Apache server and then
>passed along to the Ruby/Rails application on port 20225 with a valid
>session and all their attributes available to the application.
>