IdP TLS termination at load balancer

[Cantor, Scott]

On 4/21/15, 2:44 PM, "Sean Mason" <sean.mason at uwaterloo.ca> wrote:
>
>Is there some Jetty and/or Shibboleth configuration beyond changing the SSO HTTP-Redirect metadata endpoint that will enable this type of setup, or will I require TLS pass-through or re-encryption at the load balancer? 

Shibboleth has no direct involvement, it's simply a requirement for any correctly written web application that if you do this, you virtualize the web server appropriately.

As to whether that's possible with HTTP-proxying in Jetty, I don't know. I would assume so. Check their documentation for how to override the scheme and port of a connector. With Jetty, it's usually more about looking at their APIs and determining what properties to set in the XML that defines the connector.

Assuming you find something, adding a pointer to those docs in the wiki would be appreciated.

Offloading TLS is also not generally advisable for a back channel connector as it won't work with most Shibboleth SPs today if in fact you need that.

-- Scott