IdP TLS termination at load balancer

[Sean Mason]

Hi All,

Adding the x-forwarded-proto: https header led me down the path to a solution. 
http://eclipse.org/jetty/documentation/current/configuring-connectors.html#d0e4447 let me complete rest of the puzzle, which suggests the addition of a "ForwardedRequestCustomizer" in the configuration.  It was in the delivered jetty.xml, just commented out and waiting for me to find it.

The document: https://wiki.eclipse.org/Jetty/Howto/Configure_mod_proxy#Proxying_SSL_on_Apache_to_HTTP_on_Jetty seems to suggest that configuration of Jetty to work within this type of environment is possible without having to set x-forwarded-* headers on the load balancer, but I did not investigate any further.

I've added the Jetty reference to the Jetty9 documentation page in the Shibboleth wiki under "Optional Configuration".

Thanks again to everyone,
Sean.



> So, Sean you will need to have your load balancer (ADC) send the X-Forwarded-
> Proto request header to your Jetty container so that Jetty does not balk at the
> protocol switch / mismatch. Not sure what ADC you are using but they can all
> basically inject what ever header you want.
> 
> FWIW - If you are fronting / offloading ssl at HTTPD you have to do the same
> thing.
> 
> httpd example:  X-Forwarded-Proto “https” env=HTTPS
> f5 example: x-forwaded-proto:https


The load balancer is an F5.  
The "x-forwarded-proto: https" header was added, but the symptoms remain.

> 
> Also note.. you could just fire up jetty on 443 and not do SSL .. just use the port.
> :-)
>