Running Shibboleth behind proxy

[Cantor, Scott]

Also, note that this isn't practical as a concept unless you control every
SP. You can't make others' SPs communicate how you want them to. HTTP
proxies are not intended here, and what you publish in the metadata is
expected to be a TLS-capable endpoint. How you achieve that is entirely
your choice, but the way you're trying to do it isn't workable from a
federation point of view.

That's relevant if you're not in control of every SP.

-- Scott