External applications on a mainframe server.

[Ed HOLT]

Hi Peter,

Thanks for the quick response. For clarification, after putting in
https://sp.syspertec.com/virtel I go through and complete SSO and I can then
see a http request being sent to https://virtel.syspertec.com:41002 ( the
mainframe web server). That responds OK. The next request from the browser
is as follows:-

GET https://sp.syspertec.com/w2h/appmenu.htm+applist HTTP/1.1
Host: sp.syspertec.com
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/53.0.2785.143 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
DNT: 1
Referer: https://sp.syspertec.com/virtel
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
Cookie: SYSLANG=en; SYSSTYL=BLUE; SYSPAGE=auto;
_shibsession_64656661756c7468747470733a2f2f73702e7379737065727465632e636f6d2
f73686962626f6c657468=_827f589d964c630c2a0f7dd66281d81c

which fails with a 404  as /w2h/appmenu.htm+applist doesn't exist on the SP,
but lives on the mainframe web Server. I have tried a test using a virtual
host on the SP Apache and bypassing shibboleth. This works and I can access
my legacy applications via the mainframe web server. The only difference I
can see is that the Host header has sp.syspertec.com:41002 but when going
via shibboleth it just has sp.syspetec.com and no port.

Regards

Ed   

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: 13 October 2016 17:57
To: users at shibboleth.net
Subject: Re: External applications on a mainframe server.

* Ed HOLT <ed.holt at syspertec.com> [2016-10-13 17:40]:
> What I would like to be able to do is to reverse proxy from the SP 
> server through to the mainframe server once credentials have been 
> validate and access the mainframe applications through the Virtel web 
> server.

That's certainly possible, assuming you can make the proxied resource look
at the HTTP Request Headers you set on the proxy for authorization purposes.
Also you'd want to make sure no direct access to the proxied resource is
possible, of course, side-stepping any security the proxy would give you.

> <Location /virtel>
>   AuthType shibboleth
>   ShibRequestSetting requireSession 1
>   require shib-session
>   ProxyPass https://virtel.syspertec.com:41002/ connectiontimeout=10
timeout=30
>   ProxyPassReverse https://virtel.syspertec.com:41002/
> </location>         
> 
> When I access sp.syspertec.com/virtel I get the signin panel and 
> provide my credentials to the idp. I am then redirected to the Virtel 
> mainframe server.  Fiddler (http trace) shows a HTTP response is 
> returned from the Virtel server. Unfortunately the URL is rooted to 
> the local sp.syspertec.com. Any subsequent pages will not be found, 
> they are not being served by the external server, but by the local SP 
> server. I end up with a 404's.

If you can put up a HTML page or CGI script at /virtel at the proxy and it
works then that's all that concerns Shibboleth. The rest is httpd
configuration.
I don't follow your above error description, though. Are you saying that
you're staring at sp.syspertec.com/virtel and after the roundtrip and HTTP
POST'ing the SAML response to sp.syspertec.com/Shibboleth.sso/... you're
sent by the Shib IDP to sp.syspertec.com/ instead of sp.syspertec.com/virtel
?

If so check the RelayState parameter and its values on its way to the IDP
and back from the IDP. Is it there in both cases, and is the value
unchanged?

It may just be the (common) case of proxy/pathA not matching
proxyied-resource/pathB which is purely an httpd configuration issue that
has nothing to do with Shibboleth.

To test put a static HTML (or plain text) page at sp.syspertec.com/virtel
and access it with a fresh browser (or newly started private browing mode
browser window). If you can access that fine after SSO (to IDP and back)
that's the end of Shib's involvement.
-peter
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net