Has shibd to run on the same server

[Cantor, Scott]

On 7/30/14, 11:46 AM, "Marc Kalberer" <info at programmers.ch> wrote:

>ProxyPass        /Shibboleth.sso
>https://www.leclimatentrenosmains.org/Shibboleth.sso/

>ProxyPassReverse /Shibboleth.sso
>https://www.leclimatentrenosmains.org/Shibboleth.sso/
>But ... no changes ....

I meant you have to *not* proxy them, but I don't have the most basic idea
what this system design looks like.

Now you're talking about a reverse proxy in front of the SP, and that's
much more difficult to do. At minimum you have to completely virtualize
all kinds of settings on the back-end because the SP has to believe it's
running on the front-end. The Apache ServerName in back has to virtualize
the scheme, host, and port to match the proxy. And the metadata for the SP
needs to reflect the fact that the client is talking to the proxy, not the
back-end. This is very advanced stuff.

>I just asked the provider, he told me that his proxy is 100% transparent,
>and he his absolutely sure that it could not intercept /Shibboleth.sso

I assumed the SP was on the front end. A proxy in front means there are a
lot of potential problems in play and there's not enough information to go
on to begin to suggest a fix.

-- Scott