Handle HTTPS and HTTP to same IIS Web Site

[Alexander F. French]

I have multiple VMs running IIS behind a load-balancing reverse proxy, with SSL-offload at the load-balancer.



Regular users connect to [ https://vhost/ ].  Firewalls would prevent end users from ever connecting directly via a host name.



For troubleshooting (especially with non-prod servers, but regularly real user facing production systems), I will frequently connect directly to a specific VM over http (no SSL): [ http://hostA/ ] or [ http://hostB ].



I'm having trouble configuring the Shibboleth SP to allow both cases simultaneously.  I'm pretty sure the answer is "you'll have to connect directly over SSL, or swap out the configuration while troubleshooting if you need to inspect plain-text traffic".



I know I can't do this, because of the SSL-offload:



                <Site id="1" name="vhost">

                                <Alias>hostA</Alias>

                                <Alias>hostB</Alias>

                </Site>



So I have to specify scheme and port on the Site:



                <Site id="1" name="vhost" scheme="https" port="443">

                                <Alias>hostA</Alias>

                                <Alias>hostB</Alias>

                </Site>



Everyone is connecting to a single IIS Web Site.  Setting up a second IIS Web Site wouldn't be very helpful for troubleshooting.  (I'm not aware of any IIS option that lets me make a new IIS Web Site which truly just passes traffic onto another IIS Web Site in a way that I expect to be seamless).



I have looked at every bit of documentation I can find related to the RequestMapper and mailing list posts, and I don't think any level of flexibility I configure there is helpful- a scheme/port is about the incoming request, while the scheme/port on the <Site> define where a user is headed to.



I haven't come up with any re-direct scheme that could be implemented by my hosts or my reverse proxy that would help.



If I could define a scheme/port at the <Alias> level, and it behaved the same way as the scheme/port at the <Site> level, that would be perfect.  But a quick look at the source for isapi_shib.cpp makes it clear that this would be a straightforward but non-trivial change, and it would introduce some complexity that apparently nobody but me wants.



Is there any configuration option (or redirect option I could implement outside Shibboleth) that I'm missing?  Or do I just need to make my direct host connections over SSL, and swap configurations in non-prod cases where I want to inspect traffic for troubleshooting?



Thanks,

Alex

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180129/4e0c0986/attachment.html>