UserPassword authn fails with IdP behind reverse proxy

Mon Jul 28 16:40:07 EDT 2014

* Gregory Cook <gregorc26 at mail.com> [2014-07-28 14:36]:
> <html><head></head><body><div style="font-family: Verdana;font-size:
> 12.0px;"><div>

Please don't send HTML-only mails to the list.

> <div>We added another host with a reverse proxy in front of the IdP
> and reconfigured for it.

May I ask why you're doing that? I'm assuming it has to do with
(someone's idea of) "security" in some way or another?

> <div>The reverse proxy has ProxyPreserveHost On (httpd 2.4) to set
> the Host header sent to the IdP to the reverse proxy&#39;s
> FQDN.</div>

If you intend to put Apache httpd in front of your IDP why not use
httpd as the webserver and proxy to the java servlet container via AJP?
Of course if the proxy is (or needs to be) on another machine or on
another network you'd lose the ability to do TLS from the proxy to the
servlet container that way.
-peter