IdP TLS termination at load balancer

[Kevin Foote]

> On Apr 21, 2015, at 11:54 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 4/21/15, 2:44 PM, "Sean Mason" <sean.mason at uwaterloo.ca> wrote:
>> 
>> Is there some Jetty and/or Shibboleth configuration beyond changing the SSO HTTP-Redirect metadata endpoint that will enable this type of setup, or will I require TLS pass-through or re-encryption at the load balancer? 
> 
> Shibboleth has no direct involvement, it's simply a requirement for any correctly written web application that if you do this, you virtualize the web server appropriately.
> 
> As to whether that's possible with HTTP-proxying in Jetty, I don't know. I would assume so. Check their documentation for how to override the scheme and port of a connector. With Jetty, it's usually more about looking at their APIs and determining what properties to set in the XML that defines the connector.
> 
> Assuming you find something, adding a pointer to those docs in the wiki would be appreciated.

Ya will do. 

So, Sean you will need to have your load balancer (ADC) send the X-Forwarded-Proto request header to your Jetty container so that Jetty does not balk at the protocol switch / mismatch. Not sure what ADC you are using but they can all basically inject what ever header you want. 

FWIW - If you are fronting / offloading ssl at HTTPD you have to do the same thing. 

httpd example:  X-Forwarded-Proto “https” env=HTTPS
f5 example: x-forwaded-proto:https

Also note.. you could just fire up jetty on 443 and not do SSL .. just use the port. :-) 

--------
thanks
 kevin.foote