Issue about ServerName

Konoma konoma at be.mbn.or.jp
Thu Oct 31 00:37:52 UTC 2024


I'm setting up an Apache server and Shibboleth SP behind a LoadBalancer. 
HTTPS communication terminates at the LoadBalancer, and the Apache server receives HTTPS traffic on port 8091.
 
Due to business requirements, the following ServerName must be set in httpd.conf:
ServerName inst01:8091
 
When accessing the following URL from a browser: 
https://test.example.com/secure 
To ensure Shibboleth SP functions correctly, here are the relevant configurations from httpd.conf and shibboleth2.xml.
 
(1) Excerpt from httpd.conf
ServerName inst01:8091
 
<Location /secure> 
AuthType shibboleth 
ShibRequestSetting requireSession 1 
ShibRequestSetting applicationId inst01 
require shib-session 
</Location>
 
(2) Excerpt from shibboleth2.xml
<ApplicationOverride id="inst01"> 
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerSSL="false" cookieProps="https" redirectLimit="exact" 
handlerURL="https://test.example.com/Shibboleth.sso" consistentAddress="false" /> 
</ApplicationOverride>
 
With the above configuration:
 
Shibboleth SP correctly sent the AuthnRequest to the IdP.
The SAMLResponse from the IdP is POSTed to the following URL via the browser, 
but mod_shib fails to recognize the handler, resulting in a 404 error.
https://test.example.com/Shibboleth.sso/SAML2/POST
 
If the ServerName in httpd.conf is changed to: 
ServerName https://test.example.com
 
The mod_shib correctly recognizes the handler URL, and processing SAMLResponse successfully.
https://test.example.com/Shibboleth.sso/SAML2/POST
 
My Questions are:
 
Is the above behavior a specification of Shibboleth SP?
If the "ServerName inst01:8091" setting is necessary, is there a way to avoid the 404 error?





More information about the users mailing list