[TIP] Apache module to authenticate a NativeSPApacheConfig to the backend app and sign attributes

[Peter Schober]

* Tom Noonan <tom at joinroot.com> [2018-05-03 19:28]:
> An example use case is a docker micro-service environment where
> Apache and the backend server are in different docker containers.

You could also run shibd on the docker host (or on another
container) and share its unix domain socket with the (other) container
running httpd+mod_shib.

> Having Apache as a standalone authenticating reverse proxy which
> connects to a different backend http server (For example Puma,
> Sinatra, or Flask) over TCP is useful in some environments

OK.

Personally I wouldn't see those as -- or use their embedded -- HTTP
servers, instead I'd use uwsgi as application server and connect to
that from Apache httpd (running mod_shib) using mod_proxy_uwsgi.

Works great for Python, Perl, Rack (incl Sinatra) apps or anything
else uwsgi has support for (so not node.js and not Java, for which
there's Jetty/Tomcat, of course.)
For PHP I'd use PHP-FPM as separate fcgi server and connect to its
unix domain socket (or TCP socket) from httpd (running mod_shib) using
mod_proxy_fcgi.
In all of those cases the application or framework doesn't have to
know anything about SAML, runs as unpriviledged separate user
(possibly in another container), and in none of these cases do you
have to proxy HTTP from httpd.

Cheers,
-peter