Infinite looping of SP in load balanced production instance

[Brian Reindel]

> Then you need to virtualize Apache properly, and I would guess that you
> haven't done that. You need to look at the documentation on directives
> like ServerName. For SSL offloading, you need to include https:// in front
> of the host in the ServerName directive to virtualize the scheme.

I've seen this mentioned before, and I definitely need a better grasp
of how to configure Apache for offloading. When you say to include
"https://" for the ServerName directive, are you talking about in the
non-secure configuration file? So if our load balancer is forwarding
everything to http then that non-secure virtualhost would have
https:// in front of the host in the ServerName? If you have any good
articles on Apache that discuss these configuration changes as it
relates to SSL offloading then please pass them along.

On Thu, Oct 31, 2013 at 9:41 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/31/13, 1:36 AM, "Brian Reindel" <brian at reindel.com> wrote:
>
>>So this ended up not being the case, at least not as simply as I
>>described it. What it continues to come down to is how we should be
>>configuring our SP behind the load balancer.
>
> The basic answer is that you configure the web environment the right way
> and it just works. But few peoplpe seem to grasp how to do that. It is not
> about Shibboleth, it's about Apache.
>
>> It is taking all https
>>traffic from the outside and proxying it to http within the network.
>
> Then you need to virtualize Apache properly, and I would guess that you
> haven't done that. You need to look at the documentation on directives
> like ServerName. For SSL offloading, you need to include https:// in front
> of the host in the ServerName directive to virtualize the scheme.
>
>>I'm really struggling with how the SP should be configured given the
>>scenario. This pretty closely describes our situation
>>https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy in
>>terms of how things look to be routed. Right now all our protocols in
>>the SP metadata are https, and in Shibboleth2.xml for the SP we have
>>handlerSSL set to false, and the cookieProps has the "secure" setting.
>
> You do not need to set handlerSSL to false.
>
>>Any guidance on this would be appreciated.
>
> Configure Apache correctly for your proxying and the problems will go away.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net