how to configure mod_shib behind Load Balancer

[Cantor, Scott]

> Hmm. Virtualize schema port in ServerName like "ServerName
> sp1.test.wpv.portalverbund.at:8080“?

That isn't the virtual port, that's the physical port. Backwards. I assume the virtual port is 443.

> But what does it mean to virtualize the scheme?

Hosting an https virtual site on an http physical host. Same as port or hostname. When logical != physical, you MUST override the physical with the logical for a web server to report the right settings to applications it's hosting.

> So I tried to simplify and removed the vHost. The <location> was defined
> outside the vhost already. Shouldn’t any request match /Shibboleth.sso, like:
> curl http://10.1.1.5:8080/Shibboleth.sso/Status   # -> 404

The handler for a request when the handlerURL is relative/defaulted is computed based on the vhost of the request URL, and that comes from Apache reporting the scheme, host, and port. If the handler for a request isn't the requested URL then it's treated as a resource request and passed along.

In addition, if handlerSSL is turned on, that will prevent it from recognizing a request over http as a handler request.

> Would someone on the list have a working example config file for and SP
> with a reverse proxy?

The settings depend on the virtualization that's being done and are Apache only, the SP isn't involved. If Apache is correctly configured, the SP just works. There is nothing unusual needed in the SP configuration except on IIS, which doesn't support virtualization.

-- Scott