Infinite looping of SP in load balanced production instance

[Brian Reindel]

So just to round out this discussion in case others stumble across.
We're running Apache 2.2 and JBoss EAP 6.1. What I did in order to
bubble up some of the issues in my local environment that we're seeing
in production with the load balancer was I setup Apache httpd-ssl to
proxy over to httpd-vhosts for SSL offloading. The cookieProps are
secure, handlerSSL is set to true and all the single sign on services
in the metadata for the identity provider and all the assertion
consumer services in the metadata for the service providers are using
https. What I actually did to fix the issue was in the httpd-vhosts
virtual hosts the ServerName includes "https://" and the port number
(443), so it isn't just the host name anymore. Then in JBoss my AJP
connector needed to look like this:

<connector name="ajp" protocol="AJP/1.3" scheme="https"
socket-binding="ajp" proxy-port="443" redirect-port="443"
secure="true"/>

Everything appears to be working. We're going to test in production
this week. Hopefully this virtualization ends up fixing it.

On Thu, Oct 31, 2013 at 11:12 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/31/13, 10:55 AM, "Brian Reindel" <brian at reindel.com> wrote:
>>
>>I've seen this mentioned before, and I definitely need a better grasp
>>of how to configure Apache for offloading. When you say to include
>>"https://" for the ServerName directive, are you talking about in the
>>non-secure configuration file?
>
> Yes. A web server must always be configured to reflect the virtual host
> parameters that the client sees, not what it's actually doing physically.
> That's how the virtualization works.
>
>> So if our load balancer is forwarding
>>everything to http then that non-secure virtualhost would have
>>https:// in front of the host in the ServerName? If you have any good
>>articles on Apache that discuss these configuration changes as it
>>relates to SSL offloading then please pass them along.
>
> I do not have anything other than the Apache documentation. I don't run
> stuff this way, so it isn't my area of expertise.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net