proxy between SP and IDP with HTTP-POST binding

Thu May 3 16:58:54 EDT 2018

I could not find this question in the archives so I must be missing something obvious. Apologies if this has been answered and I didn't find it.

I am deploying a Shibboleth IDP 3.3.2. My SP requires unsolicited SSO and it seems to be working as expected. My problem is that my user agent (client browser) reaches everything through a reverse proxy, i.e. the IDP, the SP and the final target URLs must all be reached using the proxy host.

My only authentication flow is the default authn/Password. My SP metadata also requires HTTP-POST binding for the assertion consumer service. The form sent back to the browser is filled in with the "$ticket" and "$service" values as shown in postback.vm:

<body onload="document.forms[0].submit()">
<div class="wrapper">
    <div class="center">
        ...
        <form action="$service" method="post">
            <div>
                <input type="hidden" name="$ticketParamName" value="$ticket"/>
            </div>
            <noscript>
                <div>
                    <input type="submit" value="Continue"/>
                </div>
            </noscript>
        </form>
    </div>
</div>

</body>

The form action ($service) contains the SP assertion consumer service URL and the ticket value ($ticket) contains a relay state. The hosts in these values end up being those specified by the metadata (for the action) and by the target (for the relay state), however I need them to be my proxy host. The form is just data to the proxy so the proxy is no help transforming the values.

I can't be the first one in this situation so how is this typically handled? Can I transform the values in that form before it is sent?

Please let me know if you need more information.

Thanks,
Dave Dole

DXC Technology Company - Headquarters: 1775 Tysons Boulevard, Tysons, Virginia 22102, USA.
DXC Technology Company -- This message is transmitted to you by or on behalf of DXC Technology Company or one of its affiliates. It is intended exclusively for the addressee. The substance of this message, along with any attachments, may contain proprietary, confidential or privileged information or information that is otherwise legally exempt from disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient of this message, you are not authorized to read, print, retain, copy or disseminate any part of this message. If you have received this message in error, please destroy and delete all copies and notify the sender by return e-mail. Regardless of content, this e-mail shall not operate to bind DXC Technology Company or any of its affiliates to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180503/624f4a3b/attachment.html>