[EXTERNAL] RE: Setting shibboleth/apache behind nginx reverse proxy

[nicolas roggli]

That was it!!!

Thank you so much, this was driving me nuts...

Regards

Nicolas


Le 15.12.23 à 16:18, GAMBINI Gilian via users a écrit :
>
> Hello
>
> I think your httpd receive http (no ssl) requests,  shibd refuse to 
> evaluate them. Maybe you can try to set false to handlerSSL parameter 
> in shibboleth2.xml -> ApplicationDefaults -> Session ?
> https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions 
> <https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions>
>
> Regards, Gilian.
>
> ------------------------------------------------------------------------
> *De :* users <users-bounces at shibboleth.net> de la part de nicolas 
> roggli via users <users at shibboleth.net>
> *Envoyé :* vendredi 15 décembre 2023 15:51
> *À :* users at shibboleth.net
> *Cc :* nicolas roggli
> *Objet :* Setting shibboleth/apache behind nginx reverse proxy
> Hi,
>
> I am trying to setup a shibboleth/apache authentication behind an nginx
> server. Here below are my current nginx and apache config, I just
> changed the domain names.
>
> I am quite confident that nginx passes the requests to apache. When I
> access https://services.mydomain.ch, it reaches the file defined in the
> apache config (/var/www/staging/proxied/index.html) which is different
> from the root defined in the nginx config.
>
> Accessing https://services.mydomain.ch/secure does try to authenticate,
> as I receive an expected message stating
>
>  > Unknown or Unusable Identity Provider
>  >
>  > The identity provider supplying your login credentials is not
> authorized for use with this service or does not support the necessary
> capabilities.
>
> My problem, or one of, is that I cannot access
> https://services.mydomain.ch/Shibboleth.sso/Session which results in a
> 404  error. Apache logs the access, but no error except the 404.
> 127.0.0.1 - - [15/Dec/2023:15:33:03 +0100] "GET /Shibboleth.sso/Session
> HTTP/1.0" 404 .....
>
> Any idea why I can't access /Shibboleth.sso/Session ?
>
> Any suggestions are welcomed and would be greatly appreciated
>
> Nicolas
>
> ----------------- nginx -----------------
> server {
>
>      listen 80;
>      listen [::]:80;
>
>      server_name services.mydomain.ch;
>      if ($host = services.mydomain.ch) {
>          return 301 https://$host$request_uri;
>      }
> }
>
> server {
>      listen 443 ssl;
>      listen [::]:443 ssl;
>
>      server_name services.mydomain.ch;
>      root /var/www/staging/test;
>
>      access_log /var/log/nginx/services-access.log;
>      error_log /var/log/nginx/services-error.log;
>
>      index index.html;
>
>      location / {
>          proxy_set_header Host $host;
>          proxy_set_header X-Forwarded-Host $host:$server_port;
>          proxy_set_header X-Forwarded-Server $host;
>          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
>          proxy_pass http://127.0.0.1:8081;
>      }
>
>      location ~ /\.git {
>          deny all;
>      }
>
>      ssl_certificate
> /etc/letsencrypt/live/services.mydomain.ch/fullchain.pem; # managed by
> Certbot
>      ssl_certificate_key
> /etc/letsencrypt/live/services.mydomain.ch/privkey.pem; # managed by 
> Certbot
> }
>
> ----------------- apache -----------------
>
> <VirtualHost *:8081>
>      ServerAdmin webmaster at localhost
>      DocumentRoot /var/www/staging/proxied
>      <Location "/secure">
>          AuthType shibboleth
>          ShibRequestSetting entityID
> http://adfs.mydomain.ch/adfs/services/trust
>          ShibRequestSetting requireSession true
>          ShibUseHeaders On
>          Require shibboleth
>          Require valid-user
>      </Location>
>
>      ErrorLog ${APACHE_LOG_DIR}/services-error.log
>      CustomLog ${APACHE_LOG_DIR}/services-access.log combined
> </VirtualHost>
>
> -- 
> For Consortium Member technical support, see 
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231215/3b9c68c2/attachment.htm>