Apache Shib SP and target URL rewrite

[Jan Vilhuber]

> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
> Sent: Thursday, March 9, 2017 8:37 PM
> To: users at shibboleth.net
> Subject: Re: Apache Shib SP and target URL rewrite
> 
> * Jan Vilhuber <JVilhuber at absolute.com> [2017-03-09 11:33]:
> > So how can I get the assertion (or at least attributes from the
> > assertion) down to my webapp?
> 
> Concentrate on attributes first. (To get at the assertion there's a different
> method provided, involving a simple request protocol, but that presupposes you
> can already read environment variables / request headers set by the webserver,
> so you might as well use that to get at
> attributes.)
> 
> > It's entirely plausible I add some local cgi script that looks at cgi
> > environment variable and somehow passes that on to an external service
> 
> I've tried to answer all of that before, but what do you mean with passing things
> on to an external service, specifically? Unless the webserver with the Shib SP is
> acting as a reverse proxy to your "external resource" (i.e., no direct access is
> possible to the resource, but *only* through the proxy) that's likely insecure or
> requires a(nother) SSO protocol, or both. Cf.
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPOneMany
> 
[JV:] Yes, apache is acting as a reverse proxy, so I can't use environment variables, unfortunately. What I was referring to was that I could write a short-ish cgi-script of some kind, that resides on the server, and can thus use the environment (which is safer), gather the data from them, and make an API call of some kind to a server that resides behind the GW (and apache would not let direct access to).

I would be the first to admit this is a less than perfect solution. But when trying to (sloooowly) migrate an old legacy system into the 21st century, sometimes you have to take small, imperfect steps :-/ And I can wrap some static api-key around this internal (probably should have used that word instead of 'external' which implies "out in the world") API call to give it the shine of security.

I've managed to configure and verify the settings you guys pointed me at and I am on my way to a better, saml-ized world (with babysteps). Thanks for the help and the words of caution (they did not fall on  deaf ears!).

Jan

> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net