Running Shibboleth behind proxy

[Nate Klingenstein]

Prudhvi,

The scenarios in which the SP attempts to communicate directly with the IdP are rare in modern deployments and would involve attribute query or artifact resolution or single logout.  Are you sure that Shibboleth is attempting a lot of communication with these IdP's?

Since mutually authenticated TLS connections are generally the basis for trust in these exchanges, it's hard to insert a proxy in the middle of the conversation.  You can sign and encrypt these message instead, which will allow the proxy to forward the requests and responses, but it's not guaranteed that all IdP implementations will be interoperable with that change.

All other communication should be mediated by the web browser.

What Scott said about the advisability of this is still true regardless, and he probably sent you the right Wiki article too.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTransportOption

Thanks,
Nate.

On Feb 7, 2014, at 4:41 PM, "Tella, Prudhvi" <ptella at sdsc.edu>
 wrote:

> Hi,
> We are trying to identify a setting in Shibboleth that allows it to communicate with the IDP servers using a proxy rather than connecting directly. At the moment, Shibboleth is trying to establish a direct connection with the IDPs on ports 8443,443 rather than using a proxy. We want Shibboleth communication to go through our proxy server. Typically, we use http_proxy environment variable for many other programs, but I am not sure if there is a similar setting for shibboleth. Basically, all Shibboleth traffic should go through our proxy server. The only setting I have seen is for getting metadata through proxy, but I am not sure about the rest of the traffic. I appreciate any help.
>  
>  
> Thank you.
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net