proxy between SP and IDP with HTTP-POST binding

[Cantor, Scott]

On 5/3/18, 4:59 PM, "users on behalf of Dole, David" <users-bounces at shibboleth.net on behalf of ddole at dxc.com> wrote:

> The form action ($service) contains the SP assertion consumer service URL and the ticket value ($ticket) contains a relay > state. The hosts in these values end up being those specified by the metadata (for the action) and by the target (for
>  the relay state), however I need them to be my proxy host.

Then all of the URLs in all the requests and the metadata had better be referrring to the proxy and the web server(s) must all know enough to make that happen.

Reverse proxying is not transparent and all that is is virtualization, no different in nature than offloading ports or SSL. The web server(s) used must accurately report the *logical* name, port, and scheme that the client sees to the SP and IdP.

-- Scott