SP setup: Frontend NGINX, backend Apache w/ shibd ?

[Hans-Günther Schreiner]

Hello together,

 we're trying to generate a generic setup with an NGINX as frontend web server
 dealing w/ SSL and other stuff and an Apache w/ shibd as authentication via IDPs.

 The NGINX part with

  location /Shibboleth.sso {
        proxy_pass http://shibboleth:443/Shibboleth.sso;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;  # Ensure correct protocol
        proxy_set_header X-Forwarded-Port 443;     # Force port 443
        proxy_set_header X-Forwarded-Host $host;   # Use correct host without port
 }

 leads to an well-working connectivity towards the IDP but the intended protection
 of a subtree within the frontend server by i.e.

        #
        # Protect the /internal location with Shibboleth authentication via Apache
        #
        location /internal {
                auth_request /Shibboleth.sso;      # Perform authentication check via /Shibboleth.sso
                error_page 401 = @error401;       # Redirect to error page if unauthorized
                try_files $uri $uri/ =404;                # Serve content if authenticated
        }

  throws an error:

2024/10/23 10:25:23 [error] 7#7: *3 auth request unexpected status: 302 while sending to client, client: 127.0.0.1, server: fqdn, request: "GET /internal HTTP/1.1", host: "fqdn"

Any ideas how to dig deeper into this issue?

Best regards,
 Guenther
--
Hochschule Karlsruhe - Technik und Wirtschaft / Rechenzentrum (RZ)
Moltkestrasse 30
76133 Karlsruhe/Germany
Web: www.h-ka.de/rz