[EXTERNAL] Re: Problem implementing Shibboleth/SAML to authenticate users for Statistical Analysis Systems (SAS)

[Cantor, Scott]

> It *could* be that the GCP LB is presenting a generated IP
> address (in a NAT sense so to speak) for my sessions as the transaction travels
> through it, but I don’t think that is the case.

That's the norm for any LB doing HTTP proxying, which is the most common form of web LB. At the risk of pissing you off again...

If you have a reverse proxy fronting one server with another, no matter how many layers deep, somewhere the SP is going to access REMOTE_ADDR and bind its sessions to that address. It is necessary to maintain that address' fidelity from the client all the way through all the proxies to whereever the SP runs by using Forwarded-For headers to carry it along until it gets where it's going, and Apache there has to be configured to recognize it. Then it all works at least on that score.

If you don't, then either all the traffic comes from one address and it "works" or you have to turn off address binding and it "works", and you've just compromised a primary security check unless you're among the people who think spoofing addresses is really easy (it may be, but I have not been convinced of that).

I did not follow most of the rest of that description of the application but there's only one server involved as far as the SP is concerned and anything else going on is out of scope. The SP doesn't protect server A if you install it on server B, it only protects server B and the applications on B. If you're hopping between servers, there is no cookie shared between them or session of any kind, because the session with A can only ever be seen by A, not B. That’s assuming A and B are not in a proxy relationship.

Anyway, an address issue is basically always about proxying or NAT, either close to the server or more rarely at the client end. With a corporate network it's much messier and more prone to address complications and if both ends are doing it, it's a mess to deal with.

-- Scott