Moving SSL cert to the edge breaks Shibboleth

[Michael Ottoson]

Hi All,

We are converting a system we inherited: two web servers running IIS and Shibboleth, behind a load balancing server running HAPROXY. SSL certs are installed on each web server, and HAPROXY is configured as passthrough.

We want to replace the HAPROXY server with one running nginx, and we want to move the SSL cert off of the web servers to the edge, i.e. the nginx server.

We are almost there. There is one snag: Shibboleth.

We built a new server, installed and configured nginx. We use the HOSTS file to point back and forth for testing. Once we are done, we'll repoint DNS.

First, we configured nginx as a passthrough for SSL.  That worked fine.

Then we moved the cert from the web servers to the nginx server.

Requests to non-secure traffic worked fine, but anything going through Shibboleth said "Unable to locate satisfiable bearer SubjectConfirmation in assertion"

What's interesting:  If we point HOSTS to the original HAPROXY server, authenticate, then switch HOSTS to the nginx server, everything work perfectly.

In other words once the SAML cookie is set all is good. So it seems the problem happens when the IdP tries to send the assertions to .../Shibboleth.sso/SAML2/POST (Fiddler confirms)

I've posted all of this (with diagrams and conf files) on ServerFault:  https://serverfault.com/questions/884317/moving-ssl-cert-to-the-edge-breaks-shibboleth

Any advice?

--
Michael Ottoson
Director Software Development
519-946-4130

[/Users/beth_warren/Documents/Leadership +Marketing/Marketing /CRI_logos/Creative Realities Logos/CRI_logo_Black&Teal.png]

We help Clients use the latest technologies to create inspiring customer experiences
Louisville | Atlanta | Dallas | Denver | New York | Minneapolis | Tampa | Windsor ON
Connect with us at www.cri.com<http://www.cri.com/>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171120/a4ec6caf/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 4139 bytes
Desc: image001.png
URL: <http://shibboleth.net/pipermail/users/attachments/20171120/a4ec6caf/attachment.png>