SP 3 and reverseProxy

[Peter Schober]

* Jehan PROCACCIA <jehan.procaccia at tem-tsp.eu> [2018-10-28 23:13]:
> The idea beeing to install,configure and publish metadata of a
> single shibboleth SP only for the reverseProxy and not on the all
> the multiple ressources web hosts.
> 
> from
> https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy
> it seems that while using a reverseProxy we still need to deploy
> shibboleth SP on the ressource server (web applications)

You're reading old, contributed documentation on how to:
"Deploy the Service Provider behind a Reverse Web Proxy"
(i.e., the page's title).
If you're not intending to deploy the Shib SP behind a reverse proxy
(but have the web server with shib *be* the reverse proxy) you're
simply reading the wrong documentation.

While there's an even older page on the topic you're interested in
https://wiki.shibboleth.net/confluence/display/SHIB/SPForwardProxy
it's probably safe to ignore that.

> I understand that serving hundreds of web apps behind a single
> reverseProxy will be a spof and a bottleneck , but for a dozen of
> web apps is it still possible ?

Sure. You protect a resource with httpd, whether that's a local file
or something else doesn't matter to httpd.

-peter