[TIP] Apache module to authenticate a NativeSPApacheConfig to the backend app and sign attributes

[Peter Schober]

* Tom Noonan <tom at joinroot.com> [2018-05-03 19:28]:
> An environment where Apache and the backend service are isolated for
> some reason is the case this tip is aimed at.

I just realized we actually have deployed a service that operates in
this exact way, where (our) httpd+shib ("frontend") performs
authn+authz and then HTTP reverse proxies everything (with attributes
sent as custom HTTP request headers) to a remove server ("backend"),
run by another party (our Federal Ministry of the Interior).

In that case we've been using TLS to mutually authenticate the
frontend and backend, with the proxy having its own key pair, cf.
http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslproxymachinecertificatefile

Over both "nothing" and using JWT w/o TLS that provides: mutual
authentication (here with a private CA), seamless key roll-over on
both sides, confidentiality of the transport.

(Not surprisingly in this specific case the CA was imposed by the
owner of the proxied resource, so at least it isn't mine to operate,
merely to renew client certs once in a while.)

Just to +1 the "TIMTOWTDI"...

-peter