IIS 7.5 Server behind an F5 Reverse Proxy

[Christopher Bongaarts]

On 8/19/2014 10:38 AM, Meiselman, Ellen wrote:
> I  installed shibboleth on an IIS server  - call it contentserver.com 
> <http://contentserver.com>. Everything was working.
>
> Then we put that server behind an F5 reverse proxy  - let's call its 
> hostname "proxyserver.com <http://proxyserver.com>"
>
> So now, pointing the browser to *https://proxyserver.com* will display 
> content that is actually on https://contentserver.com
>
> How do I set up the SSL certs so shibboleth will work for requests 
> that come in to https://proxyserver.com? I have only very basic 
> knowledge of how to install and bind certs.
>
> Right now I can't get Shibboleth working again. The plugin is up and 
> running but I can't get the appropriate metadata from the IDP because 
> I can't give them the correct certificate - at least I don't *think* I 
> can. I don't know how to install a certificate that is for another 
> hostname.
>

Keep in mind that there are usually two sets of certificates in play 
here - an SSL certificate that is used to secure your HTTPS traffic, and 
a SAML encryption certificate that is used by Shibboleth.

Your SSL certificate is configured in the web server (IIS GUI in your 
case).  This is the one that you typically buy from a public certificate 
authority.

The Shib certificate (and corresponding private key)  is normally 
generated at installation time and lives in the Shib configuration 
directory alongside shibboleth2.xml.  Default name "shib-sp.pem" I 
think.  The certificate details are not used at all by the Shib software 
- the server name, expiration, CA signatures etc. are all irrelevant.  
It is just used as a convenient way to carry a public key.  The Shib 
certificate is the one that is included in your SP's metadata file (that 
you give to your IdP).

Also in the SP metadata file are several SAML endpoints (the XML 
elements that contain a Location attribute).  They tell the IdP how to 
direct SAML messages to your SP.  If you've changed the publicly-facing 
name of the server, you'll also need to update these endpoints so they 
contain the correct URLs (as viewed by the browser).  Since you're on 
IIS, you'll also need to verify that your Site directives in your 
shibboleth2.xml file are correct.

If you use the metadata generator endpoint (/Shibboleth.sso/Metadata), 
it will include the currently configured certificate and whatever 
virtual hostname was used to access it in the endpoints.

In all likelihood, you've left your Shib certificates alone, so in 
theory the only thing you should need to do (on the Shib side) is change 
the Locations of the endpoints in your metadata, and ask the IdP to use 
the updated metadata.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140819/5831b5ba/attachment.html