how to configure mod_shib behind Load Balancer

[Rainer Hoerbe]

I copied a functional Apache/ShibSP test configuration, and configured it to work behind a reverse proxy (nginx that shall be replaced with a Netscaler in the production environment).

However, it fails at the time the IDP response is passed to mod_shib:
AH00027: No authentication done but request not allowed without authentication for /Shibboleth.sso/SAML2/POST

The configuration is:
The nginx server is listening at https://sp1.test.wpv.portalverbund.at/, forwarding requests to http://10.1.1.8:8080/
The headers Host, X-Forwarded-Host, -Proto and -Server are added to the request.

The Apache httpd has this virtual host:
<VirtualHost *:8080>
    ServerName sp1.test.wpv.portalverbund.at
…

shib.conf contains this:
<Location /Shibboleth.sso>
  require shibboleth
  AuthType None
</Location>

Various combinations with "SetHandler shib“ and "Require all granted“ do not work either. The documentation is saying that "require shibboleth“ is not blocking access, so why does it say "request not allowed without authentication“? As said, the same configuration (except different names for vhost, entityid) without proxy is working fine.

More details to the HTTP code 500 are in the apache log:

[16:38:00.465606] [core:trace5] protocol.c(618): [client 10.1.1.2:44338] Request received from client: POST /Shibboleth.sso/SAML2/POST HTTP/1.0
[16:38:00.465734] [mod_shib:debug] mod_shib.cpp(320): [client 10.1.1.2:44338] get_request_config created per-request structure
[16:38:00.466070] [http:trace4] http_request.c(305): [client 10.1.1.2:44338]   Host: sp1.test.wpv.portalverbund.at
[16:38:00.466077] [http:trace4] http_request.c(305): [client 10.1.1.2:44338]   X-Forwarded-Host: sp1.test.wpv.portalverbund.at
[16:38:00.466083] [http:trace4] http_request.c(305): [client 10.1.1.2:44338]   X-Forwarded-Proto: https
[16:38:00.466088] [http:trace4] http_request.c(305): [client 10.1.1.2:44338]   X-Forwarded-Server: sp1.test.wpv.portalverbund.at
[16:38:00.466093] [http:trace4] http_request.c(305): [client 10.1.1.2:44338]   X-Forwarded-For: 81.217.70.83
[16:38:00.466151] [http:trace4] http_request.c(305): [client 10.1.1.2:44338]   Referer: https://idp1.test.wpv.portalverbund.at:8443/idp/profile/SAML2/Redirect/SSO?execution=e2s1
[16:38:00.466250] [mod_shib:debug] mod_shib.cpp(1588): [client 10.1.1.2:44338] shib_base_check_authz found uninitialized request object
[16:38:00.466261] [authz_core:debug] mod_authz_core.c(809): [client 10.1.1.2:44338] AH01626: authorization result of Require shibboleth : denied (no authenticated user yet)
[16:38:00.466268] [authz_core:debug] mod_authz_core.c(809): [client 10.1.1.2:44338] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[16:38:00.466278] [mod_shib:debug] mod_shib.cpp(720): [client 10.1.1.2:44338] shib_check_user entered in pid (31)
[16:38:00.466437] [core:error] [client 10.1.1.2:44338] AH00027: No authentication done but request not allowed without authentication for /Shibboleth.sso/SAML2/POST. Authentication not configured?  
[16:38:00.466462] [core:trace3] request.c(119): [client 10.1.1.2:44338] auth phase 'check user' gave status 500: /Shibboleth.sso/SAML2/POST  
[16:38:00.466501] [http:trace3] http_filters.c(1006): [client 10.1.1.2:44338] Response sent with status 500, headers: 

Changing „AuthType None“ to "AuthType shibboleth" results in a 404 with similar messages:

[17:12:00.658452] [mod_shib:debug] mod_shib.cpp(1588): [client 10.1.1.2:44363] shib_base_check_authz found uninitialized request object
[17:12:00.658466] [authz_core:debug] mod_authz_core.c(809): [client 10.1.1.2:44363] AH01626: authorization result of Require shibboleth : denied (no authenticated user yet)
[17:12:00.658473] [authz_core:debug] mod_authz_core.c(809): [client 10.1.1.2:44363] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[17:12:00.658493] [mod_shib:debug] mod_shib.cpp(720): [client 10.1.1.2:44363] shib_check_user entered in pid (31)
[17:12:00.660455] [mod_shib:debug] mod_shib.cpp(871): [client 10.1.1.2:44363] shib_auth_checker entered in pid (31)
[17:12:00.660497] [authz_core:debug] mod_authz_core.c(809): [client 10.1.1.2:44363] AH01626: authorization result of Require shibboleth : granted
[17:12:00.660508] [authz_core:debug] mod_authz_core.c(809): [client 10.1.1.2:44363] AH01626: authorization result of <RequireAny>: granted
[17:12:00.660557] [mod_shib:debug] mod_shib.cpp(921): [client 10.1.1.2:44363] shib_fixups entered in pid (31)
[17:12:00.660645] [mod_shib:debug] mod_shib.cpp(810): [client 10.1.1.2:44363] shib_handler skipped since check_user ran
[17:12:00.660697] [core:info] [client 10.1.1.2:44363] AH00128: File does not exist: /var/www/sp1TestWpvPortalverbundAt/html/Shibboleth.sso/SAML2/POST
[17:12:00.660747] [http:trace3] http_filters.c(1006): [client 10.1.1.2:44363] Response sent with status 404, headers:  

Any clue?
Best regards
Rainer