configuring shibboleth on AWS using ELB

[Nate Klingenstein]

It's hard to tell you without actually seeing your configuration, but the
only other possible cause I can think of would be a badly misconfigured IdP
initiated setup. If you're working with SP first, it's probably one of
those two issues: metadata or server misconfiguration.

On Tue, Dec 3, 2019, 8:59 AM Deirdre Kirmis <Deirdre.Kirmis at asu.edu> wrote:

> In fact, everywhere that I have ServerName configured…I have it configured
> as https://<dns name pointing to my ELB>:443
>
>
>
> Is that correct? Is there some other configuration that I missed?
>
>
>
> Deirdre Kirmis
>
> Technology Services
>
> Arizona State University Library
>
> 480-965-7240
>
>
>
> *From:* Deirdre Kirmis
> *Sent:* Tuesday, December 3, 2019 8:34 AM
> *To:* Nate Klingenstein <ndk at signet.id>; Shib Users <users at shibboleth.net>
> *Subject:* RE: configuring shibboleth on AWS using ELB
>
>
>
> So, I do already have the ServerName directive pointing to the CNAME
> record that I set up for the ELB, in all instances of “ServerName” in the
> config files (ie: httpd.conf, ssl.conf, etc) .. those files are pointing to
> the DNS entry for the load balancer. Everywhere that I am referencing my
> site is using that domain.
>
>
>
> Deirdre Kirmis
>
> Technology Services
>
> Arizona State University Library
>
> 480-965-7240
>
>
>
> *From:* Nate Klingenstein <ndk at signet.id>
> *Sent:* Tuesday, December 3, 2019 6:48 AM
> *To:* Deirdre Kirmis <Deirdre.Kirmis at asu.edu>; Shib Users <
> users at shibboleth.net>
> *Subject:* RE: configuring shibboleth on AWS using ELB
>
>
>
> Deirdre,
>
>
>
> Yes, it will work fine.  If you're using Apache, you need to virtualize
> the virtual host with the right directives, generally ServerName
> loadbalancer.asu.edu:443, so that it "thinks" it's the load balancer AND
> your metadata needs to reflect this.  You can do the same with the Site
> directive in IIS.  Many SP's are deployed like this.
>
>
>
> By virtualization, essentially, the web server needs to "think" it's the
> load balancer when examining inbound messages and generating outbound
> requests.  That's all.
>
>
>
> Take care,
>
> Nate.
>
>
>
> --------
>
>
>
> [image: Image removed by sender.]
>
> The Art of Access *®*
>
>
>
> *Nate Klingenstein* | Principal
>
> https://www.signet.id/
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.signet.id_&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=oxsob7j1y3vX9QeB4paDRVnYCAe2xrCbfc-SpQ_3EIA&s=qsHfA-ki9jhfbeMNNPmQMlsuo0ok8Fl-vvNg0ZA43zQ&e=>
>
>
>
> -----Original message-----
> *From:* Deirdre Kirmis
> *Sent:* Tuesday, December 3 2019, 6:26 am
> *To:* Nate Klingenstein; Shib Users
> *Subject:* Re: configuring shibboleth on AWS using ELB
>
> Nate, thank you so much for your response. Yes, my instance is behind a
> load-balancer, but I have a DNS entry pointing to the ELB AWS domain, which
> is what I am using for my SP address. What do you mean by "Get the
> virtualization on your instance to match ELB"? Will I be able to make this
> work?
>
> Thank you!
>
>
>
> Deirdre Kirmis
>
> Web Application Developer
>
> Discovery Services
>
> ASU Library
>
> Arizona State University
>
> 480-965-7240
>
>
> ------------------------------
>
> *From:* users <users-bounces at shibboleth.net> on behalf of Nate
> Klingenstein <ndk at signet.id>
> *Sent:* Tuesday, December 3, 2019 2:11 AM
> *To:* Shib Users <users at shibboleth.net>
> *Subject:* RE: configuring shibboleth on AWS using ELB
>
>
>
> Deirdre,
>
>
>
> > however in my server log I get an error that the attributes are null.
> When I try to "fetch" my site metadata, it just spins and never comes back
> as uploaded. When I manually upload the file, it acts like it was
> successful, but when I try the test it says my site is not registered. What
> am I doing wrong?
>
>
>
> Sorry, in my haste, I missed this part of your message.  It's most likely
> that your site is behind a load balancer(obviously) and SAMLtest can't
> issue queries directly to individual nodes behind a load balancer.  Even if
> it could, it would receive the wrong answer.  Alternative possibilities
> exist, but this one looks pretty clear.  Get the virtualization on your
> instance to match ELB and then type in ELB as your IdP address.
>
>
>
> You'd eventually have to do this with any IdP, so this is far from a
> fruitless exercise.
>
>
>
> Take care,
>
> Nate.
>
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20191203/2b913c9a/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 823 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20191203/2b913c9a/attachment.jpg>