Infinite looping of SP in load balanced production instance

[Cantor, Scott]

On 10/31/13, 1:36 AM, "Brian Reindel" <brian at reindel.com> wrote:

>So this ended up not being the case, at least not as simply as I
>described it. What it continues to come down to is how we should be
>configuring our SP behind the load balancer.

The basic answer is that you configure the web environment the right way
and it just works. But few peoplpe seem to grasp how to do that. It is not
about Shibboleth, it's about Apache.

> It is taking all https
>traffic from the outside and proxying it to http within the network.

Then you need to virtualize Apache properly, and I would guess that you
haven't done that. You need to look at the documentation on directives
like ServerName. For SSL offloading, you need to include https:// in front
of the host in the ServerName directive to virtualize the scheme.

>I'm really struggling with how the SP should be configured given the
>scenario. This pretty closely describes our situation
>https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy in
>terms of how things look to be routed. Right now all our protocols in
>the SP metadata are https, and in Shibboleth2.xml for the SP we have
>handlerSSL set to false, and the cookieProps has the "secure" setting.

You do not need to set handlerSSL to false.

>Any guidance on this would be appreciated.

Configure Apache correctly for your proxying and the problems will go away.

-- Scott