[TIP] Apache module to authenticate a NativeSPApacheConfig to the backend app and sign attributes

[Tom Noonan]

> That's what Shibboleth was created for, of course.

And it does it very well!

> Your tip fails to explain why you'd not run Shibboleth on the web server protecting the resource

That's because my original post assumes someone not running the
traditional "Apache runs the backend" model already has their own
reasons to do so.  In a traditional configuration where Apache forks
the backend service then no, this tip doesn't apply.  An environment
where Apache and the backend service are isolated for some reason is
the case this tip is aimed at.

An example use case is a docker micro-service environment where Apache
and the backend server are in different docker containers.  Having
Apache as a standalone authenticating reverse proxy which connects to
a different backend http server (For example Puma, Sinatra, or Flask)
over TCP is useful in some environments, and this tip is intended to
simply point out a way to make this configuration more secure and
robust.  I'm not trying to advocate one method over the other, they
both have pros and cons unique to the individual deployment.
--Tom Noonan II


On Thu, May 3, 2018 at 1:03 PM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Tom Noonan <tom at joinroot.com> [2018-05-03 18:22]:
>> In this configuration the backend server still requires
>> authentication (from Apache) to serve content, but the SAML heavy
>> lifting is left to Shibboleth.
>
> That's what Shibboleth was created for, of course.
>
>> - mod_proxy_jwt_auth will add Shibboleth environment variables to the
>> token and sign them.  When signature verification is on then the
>> backend server can be confident the header variables are not spoofed.
>
> Your tip fails to explain why you'd not run Shibboleth on the web
> server protecting the resource, but some other httpd module instead,
> securing the traffic between the SAML SP and the resource web server
> with another "protocol"?
> -peter
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net