Problems with IdP proxy

[Yaowen Tu]

Then I am confused. In the wiki it says:
	Inhibit the consistent address check by setting ensureConsistentClientAddress to false. 

What I understand is that IdP will not check if the address specified in AuthnRequest message is the same as the real URL. After I set ensureConsistentClientAddress to false in IdPSessionFilter it did help to resolve the first error, then I am hitting a similar error reported from SL4JCleanupFilter.

If I understood incorrectly, could you please tell me what does it mean by setting ensureConsistentClientAddress to false?

I am just trying to achieve setting up a proxy in front of multiple IdP using session stickiness. Does current Shib IdP support it? If so how can I resolve the error that I am seeing? I mean:
    SAML message intended destination endpoint 'http://sma-pc1:8080/idp/profile/SAML2/POST/SSO' did not match the recipient endpoint 'http://sma-pc1:8900/idp/profile/SAML2/POST/SSO'

In the error, sma-pc1:8080 is the proxy URL, and sma-pc1:8900 is the real IdP URL.


Thanks,
Yaowen

On Sep 17, 2013, at 9:45 PM, Jim Fox wrote:

> 
> On Sep 17, 2013, at 6:58 PM, Cantor, Scott wrote:
> 
>> On 9/17/13 9:26 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>> 
>>> Looking at the last exception again, it seems coming from
>>> IdPNoCacheFilter. It seems that I need to do the same thing for
>>> IdPNoCacheFilter like I did for IdPSessionFilter and SL4JCleanupFilter to
>>> disable the check. I don't have the environment. I will
>>> try it tomorrow and see it the request goes through.
>> 
>> Those filters have nothing like the address checking that's in the session
>> filter.
>> 
>> The proxying can't require that the URL checks fail, that can't be turned
>> off as far as I'm aware. I don't think the approach described by that
>> page, which was contributed by Jim Fox, requires that the checks be
>> disabled, so whatever you did is not equivalent.
>> 
> 
> The approach in question only required that 
> 
>  ensureConsistentClientAddress
> 
> be disabled.  A DNS thing. Nothing else.
> 
> Jim
> 
>>> 
>>> Anyways, wiki needs to be updated since changing setting for
>>> IdPSessionFilter only doesn't seems to be enough. Please let me know if I
>>> am wrong.
>> 
>> You are incorrect about the other filters being involved at least.
>> 
>> -- Scott
>> 
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130917/09ec552e/attachment.html