UserPassword authn fails with IdP behind reverse proxy

[Gregory Cook]

Right, we're using Apache httpd due to policy on what can be deployed in our various network zones.  (There's also a move here toward using mod_security.)  And we're required to use HTTPS from the httpd host in one zone to the Tomcat host in a different zone.

For the record, if someone else needs to use a similar configuration, we did resolve the issue.  We reinstalled the IdP and when install.sh prompted for the host name, we specified the host name of the reverse proxy (not the name of the app server host where we were actually doing the installation).  Thanks for the hint, Scott.

Also, sorry about the HTML mail -- should be fixed now.

> Sent: Monday, July 28, 2014 at 4:40 PM
> From: "Peter Schober" <peter.schober at univie.ac.at>
> To: users at shibboleth.net
> Subject: Re: UserPassword authn fails with IdP behind reverse proxy
>
> Please don't send HTML-only mails to the list.
> 
> > <div>We added another host with a reverse proxy in front of the IdP
> > and reconfigured for it.
> 
> May I ask why you're doing that? I'm assuming it has to do with
> (someone's idea of) "security" in some way or another?
> 
> > <div>The reverse proxy has ProxyPreserveHost On (httpd 2.4) to set
> > the Host header sent to the IdP to the reverse proxy's
> > FQDN.</div>
> 
> If you intend to put Apache httpd in front of your IDP why not use
> httpd as the webserver and proxy to the java servlet container via AJP?
> Of course if the proxy is (or needs to be) on another machine or on
> another network you'd lose the ability to do TLS from the proxy to the
> servlet container that way.
> -peter