SP ReverseProxy no attributes

[Cantor, Scott]

> The SP is on a proxy in front of the resources.

Ok, then what specifically is not getting through? The SAML portions don't involve the resources, just the SP/proxy. Once that session is established, then requests for "resources" that actually live behind the proxy should pass through the SP with a session, and the attributes will then be attached to the request within Apache.

To get anything to the back-end, you must use Apache commands like SetHeader to create data flowing to the back-end based on, e.g. system/environment variable data set on the front-end. That's generally how you have to set things up with the SP in front.

> 	User tries to hit 2, gets proxied to 1.  Authenticates with 3, and gets
> proxied back to 2.

No, 2 has to be completely invisible to the client, and can never, ever be accessed directly. It's a detail between 1 and 2 to serve the resources virtually hosted by 1 but actually living on 2. All the URLs must refer to 1.

> Is there an issue with the user hitting 2, and not 1 as the first step?

Totally, that's out of the question. No access to 2 under any circumstances except via 1 or under very controlled circumstances for internal testing.

-- Scott