Setting shibboleth/apache behind nginx reverse proxy

[nicolas roggli]

Hi,

I am trying to setup a shibboleth/apache authentication behind an nginx 
server. Here below are my current nginx and apache config, I just 
changed the domain names.

I am quite confident that nginx passes the requests to apache. When I 
access https://services.mydomain.ch, it reaches the file defined in the 
apache config (/var/www/staging/proxied/index.html) which is different 
from the root defined in the nginx config.

Accessing https://services.mydomain.ch/secure does try to authenticate, 
as I receive an expected message stating

 > Unknown or Unusable Identity Provider
 >
 > The identity provider supplying your login credentials is not 
authorized for use with this service or does not support the necessary 
capabilities.

My problem, or one of, is that I cannot access 
https://services.mydomain.ch/Shibboleth.sso/Session which results in a 
404  error. Apache logs the access, but no error except the 404.
127.0.0.1 - - [15/Dec/2023:15:33:03 +0100] "GET /Shibboleth.sso/Session 
HTTP/1.0" 404 .....

Any idea why I can't access /Shibboleth.sso/Session ?

Any suggestions are welcomed and would be greatly appreciated

Nicolas

----------------- nginx -----------------
server {

     listen 80;
     listen [::]:80;

     server_name services.mydomain.ch;
     if ($host = services.mydomain.ch) {
         return 301 https://$host$request_uri;
     }
}

server {
     listen 443 ssl;
     listen [::]:443 ssl;

     server_name services.mydomain.ch;
     root /var/www/staging/test;

     access_log /var/log/nginx/services-access.log;
     error_log /var/log/nginx/services-error.log;

     index index.html;

     location / {
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-Host $host:$server_port;
         proxy_set_header X-Forwarded-Server $host;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_pass http://127.0.0.1:8081;
     }

     location ~ /\.git {
         deny all;
     }

     ssl_certificate 
/etc/letsencrypt/live/services.mydomain.ch/fullchain.pem; # managed by 
Certbot
     ssl_certificate_key 
/etc/letsencrypt/live/services.mydomain.ch/privkey.pem; # managed by Certbot
}

----------------- apache -----------------

<VirtualHost *:8081>
     ServerAdmin webmaster at localhost
     DocumentRoot /var/www/staging/proxied
     <Location "/secure">
         AuthType shibboleth
         ShibRequestSetting entityID 
http://adfs.mydomain.ch/adfs/services/trust
         ShibRequestSetting requireSession true
         ShibUseHeaders On
         Require shibboleth
         Require valid-user
     </Location>

     ErrorLog ${APACHE_LOG_DIR}/services-error.log
     CustomLog ${APACHE_LOG_DIR}/services-access.log combined
</VirtualHost>