SSL offloading with a mostly-plain-http website

[Robin Garner]

Hi,

I'm trying to add Shibboleth authentication to an existing website that 
is mostly accessed in plaintext, but does allow https, using SSL 
offloading in an F5 load balancer.  There's a thread from 2009 entitled 
"Shibboleth 2 with SSL offloading with Big IP F5", which says "The list 
archive is full of threads about it, searching for SSL offloading would 
probably work."  The only things I can find on point link to wiki pages 
that don't exist any more.

OK, so having established that I've tried to solve the problem myself :)

The web server is Apache 2.2, Shibboleth SP 2.6.0-2.1.el5, IDP is 2.3.8. 
  This is one of ~10 virtual hosts on the server.

Here's what I started with:

In httpd.conf:
>   UseCanonicalName On

In conf.d/staff.conf:

> <VirtualHost *>
>   ServerName      staff.uat.scu.edu.au
>   DocumentRoot    /var/www/staff
> ...
>   <Location /Shibboleth.sso>
>     SetHandler shib
>     Satisfy Any
>     Allow from all
>   </Location>
>
>   <IfModule mod_alias.c>
>     <Location /shibboleth-sp>
>       Satisfy Any
>       Allow from all
>     </Location>
>     Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css
>   </IfModule>
>
>   Alias /shibtest/ /var/www/shibtest/
> </VirtualHost>
> ...
> <Directory /var/www/shibtest>
>   AllowOverride           AuthConfig
>   AuthName                "Shibboleth"
>   AuthType                shibboleth
>
>   ShibCompatWith24        On
>   ShibRequestSetting      requireSession 1
>   ShibUseEnvironment      On
>   ShibUseHeaders          Off
>   require                 shib-attr affiliation employee at scu.edu.au
> </Directory>

In shibboleth2.xml

> ...
>  <ApplicationDefaults entityID="http://uat.scu.edu.au/shibboleth"
>                          REMOTE_USER="iplanet-am-user-alias-list">
>
>   <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
>                   checkAddress="false" handlerSSL="false"
>                   cookieProps="http">
>    <SSO entityID="https://idpdev.scu.edu.au/idp/shibboleth">SAML2</SSO>
> ...

which works as far as it goes, but the response from the IdP gets POSTed 
back to a plaintext URL,

> http://staff.uat.scu.edu.au/Shibboleth.sso/SAML2/POST

and the browser complains and is obviously not desirable.  The auth 
request at this point looks like

> <?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest
>       xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>       AssertionConsumerServiceURL="http://staff.uat.scu.edu.au/Shibboleth.sso/SAML2/POST"
>       Destination="https://idpdev.scu.edu.au/idp/profile/SAML2/Redirect/SSO"
>       ID="_c5aef61e5a787fd2ac8783f3b0400a95" IssueInstant="2016-10-31T23:26:05Z"
>       ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
>    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://uat.scu.edu.au/shibboleth</saml:Issuer>
>    <samlp:NameIDPolicy AllowCreate="1"/>
> </samlp:AuthnRequest>



The IdP end is easy to sort, so how to get the SP to use its https 
endpoint in the auth request.

Now, as others have noted, setting handlerSSL="true" in shibboleth2.xml 
fails because the response comes back on in plaintext (due to offloading).

Following this suggestion,

> Add scheme to that list. Your web server believes its virtual host is not
> using SSL, but in fact it is (via the offloader). You need to tell it that
> https is in use in the Apache configuration. You also need to virtualize the
> port to 443 since the physical port is probably 80.

I've added an additional virtual host to the apache config,

> <VirtualHost *>
>   ServerAlias      https://staff.uat.scu.edu.au:443
>   DocumentRoot     /var/www/staff
>   ...
>   <Location /Shibboleth.sso>
>     SetHandler shib
>     Satisfy Any
>     Allow from all
>   </Location>
>
>   <IfModule mod_alias.c>
>     <Location /shibboleth-sp>
>       Satisfy Any
>       Allow from all
>     </Location>
>     Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css
>   </IfModule>
>
>   Alias /shibtest/ /var/www/shibtest/
>
> </VirtualHost>
>

but this doesn't seem to solve anything.

Removing the Shibboleth <Location> elements from the plain-text virtual 
host seems to make progress.  The SAML request now looks like

> <?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>       AssertionConsumerServiceURL="https://staff.uat.scu.edu.au/Shibboleth.sso/SAML2/POST"
>       Destination="https://idpdev.scu.edu.au/idp/profile/SAML2/Redirect/SSO" ID="_a86cfc3714ef1e6c6abee9c71b201cec"
>       IssueInstant="2016-11-01T05:09:21Z"
>       ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
>    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://uat.scu.edu.au/shibboleth</saml:Issuer>
>    <samlp:NameIDPolicy AllowCreate="1"/>
> </samlp:AuthnRequest>