NGINX+FastCGI Shibresponder behind load balance with SSL termination

[Kenji Nakamura]

Hi,

I use shibboleth 2.5.3 with NGINX + FastCGI.

I’m working on infrastructure refactoring and trying to put the NGINX
behind AWS ELB, and let ELB terminate SSL.

I encountered “FastCGI Shibboleth responder should only be used for
Shibboleth protocol requests.” error message, and
I interpreted it complains as the request is converted from https to http
and passed into ShibbolethResponder, which expects SSL
according to
https://github.com/craigpg/shibboleth-sp2/blob/f62a7996e195a9c026f3f8cb0e9086594b7f8515/shibsp/ServiceProvider.cpp#L486
.

What I’m looking for is the workaround described the page below for
NGINX+FastCGI.
https://wiki.shibboleth.net/confluence/display/SHIB/SPNoSSL (I expect this
is still relevant for Shib 2)

Here is the current configuration for shibresponder I use currently (with
SSL on).

    # FastCGI responder
    location /saml {
        include fastcgi_params;
        fastcgi_param  HTTPS on;
        fastcgi_param  SERVER_PORT 443;
        fastcgi_param  SERVER_PROTOCOL https;
        fastcgi_param  X_FORWARDED_PROTO https;
        fastcgi_param  X_FORWARDED_PORT 443;
        fastcgi_pass unix:/tmp/shibresponder.sock;
    }

Thanks,

*Kenji Nakamura*

Founder, Signifier, Inc.

*中村 研二*

株式会社シグニファイア 代表取締役

4-10-1 Nakano

Nakano Central Park East 1F ICTCO #23

Nakano, Tokyo, Japan 164-0001

〒164-0001

東京都中野区中野4-10-1

中野セントラルパークイースト1F ICTCO 23

Phone: +1-415-691-6297

Conf. Bridge: +1-401-283-2974

電話: 03-5356-7524

携帯: 080-9994-5623

FAX: 03-5539-4511

URL:                  http://signifier.jp

Twitter:             @k2nakamura

Skype:               kenji_signifier
Conf. Bridge:    http://www.uberconference.com/kenji_signifier
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170323/bee17fe6/attachment.html>