Running Shibboleth behind proxy

[Cantor, Scott]

On 2/7/14, 6:41 PM, "Tella, Prudhvi" <ptella at sdsc.edu> wrote:

>Hi,
>We are trying to identify a setting in Shibboleth that allows it to
>communicate with the IDP servers using a proxy rather than connecting
>directly. At the moment, Shibboleth is trying to establish a direct
>connection with the IDPs on ports 8443,443 rather than using a proxy.

There is no contact on port 443.

Direct contact over SOAP is required, unless you're prepared to use
message signing in place of TLS. We do not encourage it, and it has less
desirable security properties.

You may want to simply look into avoiding any support of SOAP to begin
with.

> We want Shibboleth communication to go through our proxy server.
>Typically, we use http_proxy environment variable for many other
>programs, but I am not sure if there is a similar setting for shibboleth.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTransportOptio
n

Provided the SP can authenticate with a signature, so signing also has to
be set to "true" or "back". The IdP should automatically support that.
However there is no MITM protection without TLS, and therefore no real
confidentiality. And therefore a lot less reason to bother. Just push
attributes instead if you don't care about confidentiality.

-- Scott