Infinite looping of SP in load balanced production instance

[Brian Reindel]

That fixed the issue in production, and thankfully it didn't break any
of our other apps on that virtual host. Thanks again for the
assistance.

On Mon, Nov 4, 2013 at 3:43 PM, Brian Reindel <brian at reindel.com> wrote:
> So just to round out this discussion in case others stumble across.
> We're running Apache 2.2 and JBoss EAP 6.1. What I did in order to
> bubble up some of the issues in my local environment that we're seeing
> in production with the load balancer was I setup Apache httpd-ssl to
> proxy over to httpd-vhosts for SSL offloading. The cookieProps are
> secure, handlerSSL is set to true and all the single sign on services
> in the metadata for the identity provider and all the assertion
> consumer services in the metadata for the service providers are using
> https. What I actually did to fix the issue was in the httpd-vhosts
> virtual hosts the ServerName includes "https://" and the port number
> (443), so it isn't just the host name anymore. Then in JBoss my AJP
> connector needed to look like this:
>
> <connector name="ajp" protocol="AJP/1.3" scheme="https"
> socket-binding="ajp" proxy-port="443" redirect-port="443"
> secure="true"/>
>
> Everything appears to be working. We're going to test in production
> this week. Hopefully this virtualization ends up fixing it.
>
> On Thu, Oct 31, 2013 at 11:12 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>> On 10/31/13, 10:55 AM, "Brian Reindel" <brian at reindel.com> wrote:
>>>
>>>I've seen this mentioned before, and I definitely need a better grasp
>>>of how to configure Apache for offloading. When you say to include
>>>"https://" for the ServerName directive, are you talking about in the
>>>non-secure configuration file?
>>
>> Yes. A web server must always be configured to reflect the virtual host
>> parameters that the client sees, not what it's actually doing physically.
>> That's how the virtualization works.
>>
>>> So if our load balancer is forwarding
>>>everything to http then that non-secure virtualhost would have
>>>https:// in front of the host in the ServerName? If you have any good
>>>articles on Apache that discuss these configuration changes as it
>>>relates to SSL offloading then please pass them along.
>>
>> I do not have anything other than the Apache documentation. I don't run
>> stuff this way, so it isn't my area of expertise.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net