SSL offloading with a mostly-plain-http website

[Robin Garner]

On 02/11/16 01:01, Cantor, Scott wrote:
>> Here's what I started with:
>
> Write a simple CGI script to dump the environment and you'll see the variables like SERVER_NAME, SERVER_PORT, and one called HTTPS that will contain "on" if it's https.

Yup.  Done.

Looks like HTTPS is only set by mod_ssl, and so it will be off when 
using SSL offload.  I've tried

   SetEnvIf X-Forwarded-Proto https HTTPS=on

but I can't see any evidence that this changes any behavior.

> You need to configure Apache to make sure those are all set such that building a URL with them will give you the result you want when you access the vhost. Then make the CGI script a protected resource and the SP will work.
>
> That's all up to Apache and is controlled with ServerName.
>
> -- Scott
>

So what I think you're saying is that I configure the virtual host as

> <VirtualHost *>
> ServerName      https://staff.uat.scu.edu.au:443
>

and the SP with

>        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
>                   checkAddress="false" handlerSSL="true" cookieProps="http">
>

This does indeed let me log in, posting user credentials back via an SSL 
endpoint.


The problem is that the subsequent redirect address is now

https://staff.uat.scu.edu.au/shibtest/index.php


I had a wild stab at setting the ServerName back to its original setting 
and telling the SP only that it was on an HTTP connection like this:

>   <Location /Shibboleth.sso>
>     SetHandler shib
>     SetEnv SERVER_NAME staff.uat.scu.edu.au
>     SetEnv HTTPS on
>     SetEnv SERVER_PORT 443
>     Satisfy Any
>     Allow from all
>   </Location>

but this breaks the configuration completely.