<div class="gmail_quote">On Wed, Jan 25, 2012 at 5:36 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">> It is the lack of the 'content-length' header in particular that our application<br>
> complains about on the POST request. However, the application will also be<br>
> needing additional Shib-specific headers (locally-defined attributes) that are<br>
> also not getting passed. Additionally, the x-forwwarded-* headers go<br>
> missing as well as the 'connection' header. What could be stripping these<br>
> headers upon turning on ShibUseHeaders? I assume ShibSP is doing this.<br>
<br>
</div>It's not. The SP has no involvement in this whatsoever. It sets the request headers on the Apache request object. After that, anything that happens is the Apache handler that actually serves the request.<br></blockquote>
<div><br>Sorry, I specifically meant the Apache mod_shib module -- which is bundled in my "ShibSP" software. <br></div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class="im"><br>
> Does anyone run a proxy that is Shib-protected? Are you using<br>
> ShibUseHeaders? We are running Apache 2.2 and ShibSP 2.4.3.<br>
<br>
</div>I believe we have one in front of a Tomcat server, but I don't know if any of those headers are "missing" or any other details, just that they did it. I don't know if the proxy end needs the headers option or if it just sets them for the proxied hop directly based on environment variables.<br>
<font color="#888888"><br></font></blockquote><div>Care to share your Apache configuration -- in particular, the Shib- and Proxy-related lines? Here's what I'm using in case anyone sees something obviously wrong (I've pared it down a lot):<br>
<br>Listen 160.94.xxx.yyy:80<br>Listen 160.94.xxx.yyy:443<br>Listen 160.94.xxx.yyy:4443<br><br>LoadModule log_config_module libexec/mod_log_config.so<br>LoadModule ssl_module libexec/mod_ssl.so<br>LoadModule mod_shib /opt/shibboleth-sp/lib/shibboleth/mod_shib_22.so<br>
LoadModule rewrite_module libexec/mod_rewrite.so<br>LoadModule proxy_module libexec/mod_proxy.so<br>LoadModule proxy_http_module libexec/mod_proxy_http.so<br><br>SSLProxyEngine On<br>ProxyPass / <a href="https://localhost/">https://localhost/</a><br>
ProxyPassReverse / <a href="https://localhost">https://localhost</a><br><br><Location /><br> AuthType shibboleth<br> ShibRequestSetting requireSession 1<br> ShibUseHeaders On<br> require valid-user<br></Location><br>
<br>ServerTokens Full<br>ServerSignature On<br><br>SSLRandomSeed connect builtin<br>SSLRandomSeed startup file:/dev/urandom 512<br>SSLPassPhraseDialog builtin<br>SSLSessionCache shmcb:/var/opt/apache/...<br>SSLSessionCacheTimeout 300<br>
SSLMutex file:/var/opt/apache/...<br>SSLEngine on<br>SSLCipherSuite HIGH:MEDIUM:!SSLv2:!ADH:!NULL<br>SSLCertificateFile /etc/opt/apache/.../srv.crt<br>SSLCertificateKeyFile /etc/opt/apache/.../srv.key<br><br><VirtualHost _default_:80><br>
CustomLog /var/opt/apache/.../access-80 combined<br> ErrorLog /var/opt/apache/.../errors-80<br> SSLEngine off<br> RewriteEngine On<br> RewriteRule ^/ https://###.<a href="http://umn.edu">umn.edu</a> [L,R]<br>
</VirtualHost><br><br><VirtualHost _default_:4443><br> CustomLog /var/opt/apache/.../access-4443 combined<br> ErrorLog /var/opt/apache/.../errors-4443<br> SSLEngine on<br></VirtualHost><br><br><br>
</div></div>