Moving SSL cert to the edge breaks Shibboleth

[Domingues, Michael D]

Michael,


You can find the main wiki for all Shibboleth project documentation here: https://wiki.shibboleth.net/


The page you are interested in (as Scott described) can be found here: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPISAPI


Best,

Michael

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Boyd, Todd M. <tmboyd1 at ccis.edu>
Sent: Monday, November 20, 2017 2:27:00 PM
To: Shib Users
Subject: RE: Moving SSL cert to the edge breaks Shibboleth

Could you potentially lie to the stack that sits on IIS using something like IIS URL Rewrite and replacing server variables? I know there were a few small web applications running on IIS we were able to "trick" this way by setting things such as the HTTPS, SERVER_PORT, SERVER_PORT_SECURE, etc. variables.


-Todd


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, November 20, 2017 2:22 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Moving SSL cert to the edge breaks Shibboleth

> Can you help me understand (or link to a doc that does)?

If you're asking me to explain how web server virtualization works, I guess I would suggest you read the Apache ServerName documentation, I don't know of any particularly good source on the basics of web server deployment. If you're talking about the SP workaround, it's under NativeSPISAPI in the wiki.

>  We've been using Shibboleth for months successfully.  We haven't
> changed any names - only moved the cert.

That cannot break it. You changed the virtualization of the site, you had to have. I would imagine it was physically https before and now it's physically http and still logically https. So you MUST tell the web server that it is in fact logically running on https. Which you cannot do, IIS doesn't support that, but you can hack it by telling the SP that in the <Site> element that's already present, using the scheme attribute.

-- Scott

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171120/83b014a2/attachment.html>