Redirect loop after changing to name based virtual hosts

[Cantor, Scott]

On 3/5/13 5:27 PM, "Ferenc Wagner" <wferi at niif.hu> wrote:
>
>Thanks for the tip, this indeed proved useful, although I still don't
>quite understand how the problem came around.  But it was fixed by
>including the URI scheme (https://) into the ServerName directives in
>the Apache virtual host configurations.

That means you're virtualizing SSL and offloading it. Virtualizing the
scheme is required if you're going to do that.

>Before that the "DEBUG
>Shibboleth.Apache [X] shib_check_user: mapped ..." logs always mentioned
>nonexistent http:// URIs.

They exist, it's the https:// URLs that are virtual.

>  Actually, these virtual host configurations
>do not contain SSL directives anymore, but use the SSL configuration of
>the default virtual host (being name based and without SNI).  For us,
>sticking https:// into ServerName is no problem, but I wonder if a more
>general solution is possible.  UseCanonicalName also didn't change the
>situation.

That is the general solution.

>The exact same Shibboleth configuration works with IP based virtual
>hosts, so I don't expect a problem here.

That doesn't follow, because the mappings to applicationId are entirely
based on the URL as virtualized by the server. Virtual hosts are all about
playing games with that information in various ways, some minimal, some
very significant.

-- Scott