how to configure mod_shib behind Load Balancer

[Cantor, Scott]

> So you are saying that mod_shib will only with virtual hosts, not with the
> global configuration?

A global configuration in Apache is just the default vhost.

> My limited knowledge is that http host virtualization is just matching listener-
> IP/port or Host headers with VirtualHost directives.

Host virtualization is overriding the physical parameters of a request with logical values. If a load balancer is taking requests for https://logical:443 and dispatching them to http://physical:8080, the web server needs to tell its applications that it's listening on https://logical:443, and ServerName in Apache is how you configure all of that. There used to be incomplete support for that, and a lot of different settings involved, and then they collapsed them all down into ServerName.

> As a result, the file
> content handler does match the URL - the request finally goes to the correct
> document root.

The document root doesn't care what its URL is though.

> This does work behind load balancers. The configuration with
> mod_shib seems to require be a magic I do not understand.

Any application that functions in a system that doesn't have ServerName set correctly would be broken in exactly the same way if it needs to know its own URL. The SP just happens to need to know that, to compute a self-referential redirect. If it asks for SERVER_NAME or SERVER_PORT and gets back a physical, inaccessible value the client can't reach, it's not going to work. It has to get the logical value back from the web server. That's the virtualization part.

> I read thru  apache docs again, but I could not find any explanations of what you are
> recommending. So I beg humbly for the right keywords to look up, or a
> example of vhost+shib.conf working behind a proxy.

The only Apache command involved here is normally ServerName. I don't know the full set of virtualization differences in your system, but ServerName is pretty well documented. If the logical vhost is https://logical.com:443, that's pretty much the value to use.

As far as the SP is concerned, Apache needs to tell it that it's running on https://logical.com:443 and if it does that, the SP just works.

-- Scott