configuring shibboleth on AWS using ELB

[Deirdre Kirmis]

In fact, everywhere that I have ServerName configured…I have it configured as https://<dns name pointing to my ELB><https://%3cdns%20name%20pointing%20to%20my%20ELB%3e>:443

Is that correct? Is there some other configuration that I missed?

Deirdre Kirmis
Technology Services
Arizona State University Library
480-965-7240

From: Deirdre Kirmis
Sent: Tuesday, December 3, 2019 8:34 AM
To: Nate Klingenstein <ndk at signet.id>; Shib Users <users at shibboleth.net>
Subject: RE: configuring shibboleth on AWS using ELB

So, I do already have the ServerName directive pointing to the CNAME record that I set up for the ELB, in all instances of “ServerName” in the config files (ie: httpd.conf, ssl.conf, etc) .. those files are pointing to the DNS entry for the load balancer. Everywhere that I am referencing my site is using that domain.

Deirdre Kirmis
Technology Services
Arizona State University Library
480-965-7240

From: Nate Klingenstein <ndk at signet.id<mailto:ndk at signet.id>>
Sent: Tuesday, December 3, 2019 6:48 AM
To: Deirdre Kirmis <Deirdre.Kirmis at asu.edu<mailto:Deirdre.Kirmis at asu.edu>>; Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: configuring shibboleth on AWS using ELB


Deirdre,



Yes, it will work fine.  If you're using Apache, you need to virtualize the virtual host with the right directives, generally ServerName loadbalancer.asu.edu:443, so that it "thinks" it's the load balancer AND your metadata needs to reflect this.  You can do the same with the Site directive in IIS.  Many SP's are deployed like this.



By virtualization, essentially, the web server needs to "think" it's the load balancer when examining inbound messages and generating outbound requests.  That's all.



Take care,

Nate.



--------



[Image removed by sender.]

The Art of Access ®



Nate Klingenstein | Principal

https://www.signet.id/<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.signet.id_&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=oxsob7j1y3vX9QeB4paDRVnYCAe2xrCbfc-SpQ_3EIA&s=qsHfA-ki9jhfbeMNNPmQMlsuo0ok8Fl-vvNg0ZA43zQ&e=>


-----Original message-----
From: Deirdre Kirmis
Sent: Tuesday, December 3 2019, 6:26 am
To: Nate Klingenstein; Shib Users
Subject: Re: configuring shibboleth on AWS using ELB

Nate, thank you so much for your response. Yes, my instance is behind a load-balancer, but I have a DNS entry pointing to the ELB AWS domain, which is what I am using for my SP address. What do you mean by "Get the virtualization on your instance to match ELB"? Will I be able to make this work?
Thank you!

Deirdre Kirmis
Web Application Developer
Discovery Services
ASU Library
Arizona State University
480-965-7240

________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Nate Klingenstein <ndk at signet.id<mailto:ndk at signet.id>>
Sent: Tuesday, December 3, 2019 2:11 AM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: configuring shibboleth on AWS using ELB


Deirdre,



> however in my server log I get an error that the attributes are null.  When I try to "fetch" my site metadata, it just spins and never comes back as uploaded. When I manually upload the file, it acts like it was successful, but when I try the test it says my site is not registered. What am I doing wrong?



Sorry, in my haste, I missed this part of your message.  It's most likely that your site is behind a load balancer(obviously) and SAMLtest can't issue queries directly to individual nodes behind a load balancer.  Even if it could, it would receive the wrong answer.  Alternative possibilities exist, but this one looks pretty clear.  Get the virtualization on your instance to match ELB and then type in ELB as your IdP address.



You'd eventually have to do this with any IdP, so this is far from a fruitless exercise.



Take care,

Nate.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20191203/1136ed47/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 823 bytes
Desc: image001.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20191203/1136ed47/attachment.jpg>