Apache2.2/mod_shib and proxying to remote app servers

[Simon Gaeremynck]

Hello,

I have a deployment question. Let me first roughly sketch out our current deployment infrastructure:

We have a pool of Node.JS app servers that run on different VMs for availability.
Each Node.JS app server exposes it’s own HTTP server with express [1].
A load balancer (apache) sits in front of those app servers (on a separate VM).
Users can only talk to Apache which then proxies those requests to the application servers over HTTP.

By following the docs I was able to integrate mod_shib and authenticate with the TestShib IdP into our application successfully.
This was done by installing the shib sp software and mod_shib on the load balancer and relying on the fact that mod_shib injects the appropriate headers into the request when proxying an incoming HTTP request to our app servers.

However, the docs [2] clearly state that you should not rely on this feature and use environment variables instead.
I’m not entirely sure how that would work when the application can’t run under CGI and is based on an event-loop (ie: no threads/process to start up for each request).

Is there anything obvious that I’m missing here or is the setup as we have it accepted when dealing with these type of applications?
FWIW, installing apache/mod_shib on each app server is something we’d be OK with (obviously we’d rather not do it if there is no need, but we’re not vehemently opposed).

Kind regards,

Simon


[1] http://expressjs.com
[2] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSpoofChecking#NativeSPSpoofChecking-Apache
Under no circumstances should you rely on the request header option other than as a temporary measure while adjusting applications to use the environment option. There are no known scenarios in which environment variables can't be used, including with Java containers, though sometimes extra effort or Apache settings may be needed. Do NOT take shortcuts with this. Do the work and use them.