SAML1.1 attribute release on Shib 3

[Cantor, Scott]

On 2/15/17, 1:58 PM, "users on behalf of Morris, Andi" <users-bounces at shibboleth.net on behalf of amorris at cardiffmet.ac.uk> wrote:

> Alex, thanks also for replying and showing the test sp logs. That really helps to narrow this down. We have a load balancer
> providing reverse proxy, so I guess it must be something that's doing.

You can't reverse proxy the back channel, at least not easily, most older SPs are not going to know to sign their requests and will be expecting to use a client certificate.

This isn't a change, if you have something working today you would have to set it up the same way.

> As far as I know we're not doing any offloading, or similar type
> inspection, but I will definitely look further at that when I'm back in tomorrow.

Proxying is the same as, if not worse and more invasive than, offloading.

-- Scott