SAML1.1 attribute release on Shib 3

[Morris, Andi]

Hi Dave,
We also use TMG for our Shib 2 environment including the backchannel, but that's being phased out, and have other hardware load balancers acting as reverse proxies for our Shib 3 environment. I checked the backchannel rule on our TMG (I'm also the TMG admin) and it's not doing anything special at all, I was actually quite surprised to see it's actually presenting the TMG NAT address to the Shib 2 IdP.

Anyway, putting the Shib 3 IdP in the DMZ has resolved this, so I at least know that this attribute issue is definitely to do with the reverse proxy setup I was using, so I can try and troubleshoot that elsewhere.

Thanks for the advice all

Andi

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Dave Perry
Sent: 16 February 2017 10:18
To: Shib Users <users at shibboleth.net>
Subject: RE: SAML1.1 attribute release on Shib 3

For the record, we ran our v2 IdP as a VM in the DMZ, but I deliberately made the v3 one internal. Eventually we want the Kerberos side setup for internal SSO, but that requires time with our AD admin and he's too busy with more important stuff.

We use (now unsupported admittedly) MS Forefront TMG as the reverse proxy here, it makes loads of our services available externally. Our admin was able to make it pass all the traffic straight to my VM, and the backchannel. So I control the certificates in Jetty.
It took a few goes against the UKF Test SP to get backchannel sorted, but we got there.

I did try asking him to export the rules for our VM once, but he said it didn't come out in a neat XML or CSV-style format.


Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group (Monday - Thursday)

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 15 February 2017 19:27
To: Shib Users
Subject: Re: SAML1.1 attribute release on Shib 3

On 2/15/17, 2:10 PM, "users on behalf of Morris, Andi" <users-bounces at shibboleth.net on behalf of amorris at cardiffmet.ac.uk> wrote:

> Strange, we have saml1.1 working with a reverse proxy currently, and it had been working well for years.

Then I would suggest you're missing a piece of information somewhere. There is something about what you're doing now you're not taking into account, but I don't know what it might be. The most likely is just that you're not proxying port 8443, only 443.

> That's on shib 2.

Both versions are going to require authentication of the query unless you have deliberately disabled the checking, and only one way of doing that works with proxies. And that way doesn't work out of the box with Shibboleth SPs operating in with the defaults, it doesn't sign messages sent over SOAP.

> Short of putting the IdP in the DMZ that's the only way I can see to
> do it, which could be an option I guess. It's far from ideal however.

Then I think you may be in for a surprise when you figure out what you're doing already.

My servers are load balanced at layer 4 with end to end TLS, though that isn't because of the back channel, it's because proxying makes it extremely difficult to get a trustworthy client address and operating an IdP without trustworthy client addresses is itself a much bigger security risk to my users than not proxying is. The concept of a DMZ means nothing to me, I don't trust any network.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee only. It may  contain confidential or sensitive information.  The contents are not to be disclosed to anyone other than the addressee.  Unauthorised recipients are requested to preserve this confidentiality and to advise us of any errors in transmission.  Any views expressed in this message are solely the views of the individual and do not represent the views of the College.  Nothing in this message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________

[Cardiff Metropolitan University - Queens Anniversary Prizes 2015]<http://www.cardiffmet.ac.uk/news/Pages/Cardiff-Met-research-recognised-in-Queens-Anniversary-Prizes-for-Higher-and-Further-Education.aspx>