Has shibd to run on the same server

[Marc Kalberer]

Le 30/07/2014 18:05, Cantor, Scott a écrit :
> On 7/30/14, 11:46 AM, "Marc Kalberer" <info at programmers.ch> wrote:
>
>> ProxyPass        /Shibboleth.sso
>> https://www.leclimatentrenosmains.org/Shibboleth.sso/
>> ProxyPassReverse /Shibboleth.sso
>> https://www.leclimatentrenosmains.org/Shibboleth.sso/
>> But ... no changes ....
> I meant you have to *not* proxy them, but I don't have the most basic idea
> what this system design looks like.
>
> Now you're talking about a reverse proxy in front of the SP, and that's
> much more difficult to do. At minimum you have to completely virtualize
> all kinds of settings on the back-end because the SP has to believe it's
> running on the front-end. The Apache ServerName in back has to virtualize
> the scheme, host, and port to match the proxy. And the metadata for the SP
> needs to reflect the fact that the client is talking to the proxy, not the
> back-end. This is very advanced stuff.
maybe I wrongly describe the environment.
     ServerName inside is "www.leclimatentrenosmains.org"
there is no name changes, or what ever.
My ProxyPass test was wrongly mentionned, it was just to specify that I 
tried many different configurations / solutions

>
>> I just asked the provider, he told me that his proxy is 100% transparent,
>> and he his absolutely sure that it could not intercept /Shibboleth.sso
> I assumed the SP was on the front end. A proxy in front means there are a
> lot of potential problems in play and there's not enough information to go
> on to begin to suggest a fix.
>
> -- Scott
>

-- 
*Programmers.ch*
Développement WEB
Solutions libres et Opensources
Tel: ++41 76 44 888 72
Site: http://www.programmers.ch
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140730/cc1fb8d4/attachment.html