<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FI" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hey all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US">In hope of someone else finding this useful, I’ll post my solution to a problem that was not completely straightforward to solve.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">We’re migrating from shibboleth built-in ldap authentication to a reverse proxy based authentication solution, which allows custom headers to be injected in the request for the back end server which back end servers are
supposed to trust. The problem was to get apache or shibboleth accept the custom header that contains the username.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The solution was apache’s built in <a href="http://httpd.apache.org/docs/2.2/mod/mod_authn_anon.html">
http://httpd.apache.org/docs/2.2/mod/mod_authn_anon.html</a> which accepts any password from a basic auth header. The reverse proxy was configured to inject a basic auth header with a static password for all users. We combined this with a shared secret and
of course https connections from reverse proxy to shibboleth server. Shared secret is another custom header, and is validated with apache config. Like so:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><Location /idp/Authn/RemoteUser><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> SSLRequireSSL<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> AuthType Basic<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> AuthName "Restricted"<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> AuthBasicProvider anon<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Anonymous anonymous *<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> Require valid-user<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> SetEnvIfNoCase X-Shared-Secret "open sesame" ok<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> order deny,allow<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> deny from all<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> allow from env=ok<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"></Location><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FI">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FI">Viljo Viitanen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:FI">University of Jyväskylä<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>