Oracle OAM Federation behind SSL proxy

[Cameron Kerr]

Thinking of other similar OAM and WebLogic work I have done (although not SAML):

- there is a deployment document from BigIP that might be of interest. Useful material for any weblogic deployment and for any reverse proxy environment. 

- even if you don't use httpd/OHS with mod_weblogic, you should have the 'use weblogic module' enabled for all member servers that will be used through the reverse proxy. This will cause it to trust certain HTTP headers that mod_weblogic would sent (and that BigIP would also be configured to send - headers that do things like contain the clients IP and whether it come in over SSL). This is critical. 

- if you are using OHS (with mod_weblogic) behind BigIP, then you'll similarly want to enable the OHS directive to use webcache IP (and you'll get the BigIP to set the header for that). That will cause OHS to know the client's IP at least (which mod_weblogic would also use)

- if you are using httpd instead of OHS, then you can use the likes of mod_remoteip instead. 

- OAM will further require some other headers (IS_SSL?) to communicate whether SSL was used — same purpose but different header and syntax compared to the one for WebLogic.

- There is no/little documentation for it, but you can learn a lot about the http headers used observing the traffic between mod_weblogic and a WebLogic managed server. If you can't sniff the traffic, the debug settings for mod_weblogic provide enough detail if enabled. 

- the documentation for weblogic module 12c is still quite relevant for 11g, and contains a description for an option that trusts the header that the reverse-proxy will set to communicate the client's IP. 

- use cookie insert persistence in your load balancing. 

- as a debugging aid, make any http:// access redirect to something that says "you got sent to an insecure page, this should not happen". This will make it easier to spot places where you come in over https, get redirected to http (because of missing reverse-proxy headers) and potentially get sent back to https. 

- The A-Team have a number of excellent blog posts on this subject. 

Sent from my iPhone (and on holiday, hopefully this is enough for you to Google). 

On 23/12/2016, at 6:25 AM, Eric Goodman <Eric.Goodman at ucop.edu> wrote:

>> Why not ask the company that takes your money for support and 
>> license fees (both do, but it's Oracle's product you need to configure)?
> 
> A hahahaha...You guys crack me up! 
> 
> 
> We have an analogous setup with our own OAM SP (the private and public URLs being different) and have no issues^H^H^H^H^H^H don't have this particular issue with the config. OAM can be configured to redirect to the public URLs (and those can also be listed in the metadata) and I assume that's what you need them to change in their config. The OAM folks from my shop appear to be gone for the holidays, but if you're still having issues and the SR isn't successful in early Jan, check in with me offlist and I'll see if I can get and send you a documentation pointer.
> 
> --- Eric 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net