Proxying server setup help

[Cantor, Scott]

On 1/20/16, 4:44 PM, "users on behalf of Antony den Dulk" <users-bounces at shibboleth.net on behalf of antony at selestiasolutions.com> wrote


>
>I am not sure I understand what you are saying here. Is the IP address
>of foo.example.org the same as www.example.org? If so, then the server
>should know that foo.example.org should be reversed proxied to the
>same server as www.example.org/foo. Is that what you are describing
>here?

No, he's saying that www.example.org/foo is being routed to foo.example.org/foo. See the path? It MUST match or you're dead, full stop.

>Do you happen to have an example of this? I can then see if I can
>adapt it to my situation.

You either have to replicate the path across the front and back, or you have no way of using the SP. The rest is documented, you should read the ApplicationModel topic that explains the way the SP is architected and how overrides work.

The point is that virtualizing the host is fine. Changing paths isn't. The paths are seen by the IdP and included inside signed messages and cannot be rewritten before they get to the SP. If you want that to work, you would need to move the SP portion up front to the proxy, or find a different SAML implementation that is designed in a fundamentally different way.

-- Scott