SAML1.1 attribute release on Shib 3

[Dave Perry]

For the record, we ran our v2 IdP as a VM in the DMZ, but I deliberately made the v3 one internal. Eventually we want the Kerberos side setup for internal SSO, but that requires time with our AD admin and he's too busy with more important stuff.

We use (now unsupported admittedly) MS Forefront TMG as the reverse proxy here, it makes loads of our services available externally. Our admin was able to make it pass all the traffic straight to my VM, and the backchannel. So I control the certificates in Jetty.
It took a few goes against the UKF Test SP to get backchannel sorted, but we got there.

I did try asking him to export the rules for our VM once, but he said it didn't come out in a neat XML or CSV-style format.


Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group (Monday - Thursday)

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 15 February 2017 19:27
To: Shib Users
Subject: Re: SAML1.1 attribute release on Shib 3

On 2/15/17, 2:10 PM, "users on behalf of Morris, Andi" <users-bounces at shibboleth.net on behalf of amorris at cardiffmet.ac.uk> wrote:

> Strange, we have saml1.1 working with a reverse proxy currently, and it had been working well for years.

Then I would suggest you're missing a piece of information somewhere. There is something about what you're doing now you're not taking into account, but I don't know what it might be. The most likely is just that you're not proxying port 8443, only 443.

> That's on shib 2.

Both versions are going to require authentication of the query unless you have deliberately disabled the checking, and only one way of doing that works with proxies. And that way doesn't work out of the box with Shibboleth SPs operating in with the defaults, it doesn't sign messages sent over SOAP.

> Short of putting the IdP in the DMZ that's the only way I can see to 
> do it, which could be an option I guess. It's far from ideal however.

Then I think you may be in for a surprise when you figure out what you're doing already.

My servers are load balanced at layer 4 with end to end TLS, though that isn't because of the back channel, it's because proxying makes it extremely difficult to get a trustworthy client address and operating an IdP without trustworthy client addresses is itself a much bigger security risk to my users than not proxying is. The concept of a DMZ means nothing to me, I don't trust any network.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT