[TIP] Apache module to authenticate a NativeSPApacheConfig to the backend app and sign attributes

[Peter Schober]

* Tom Noonan <tom at joinroot.com> [2018-05-03 18:22]:
> In this configuration the backend server still requires
> authentication (from Apache) to serve content, but the SAML heavy
> lifting is left to Shibboleth.

That's what Shibboleth was created for, of course.

> - mod_proxy_jwt_auth will add Shibboleth environment variables to the
> token and sign them.  When signature verification is on then the
> backend server can be confident the header variables are not spoofed.

Your tip fails to explain why you'd not run Shibboleth on the web
server protecting the resource, but some other httpd module instead,
securing the traffic between the SAML SP and the resource web server
with another "protocol"?
-peter