Hi Scott,<div> When the front-facing proxy receives a message on URL at <a href="http://idp.example.edu">idp.example.edu</a> (SSL Certificate) it rewrites the URL to communicate with the back-end Shibboleth server to <a href="http://shib.example.edu">shib.example.edu</a>. This breaks the SAML implementation which (like you said) requires that the URL that receives the message also matches the SAML EndPoint Location. The original question is whether or not there is a way of managing this problem via SAML configuration, a hack or something more elegant. I'm open to options. Do you have any? And yes there are several conversations about using reverse proxy with IDP Shibboleth but most of them are several years old. Here's one from 2009:</div>
<div><br></div><div><a href="https://lists.internet2.edu/sympa/arc/shibboleth-users/2009-09/msg00226.html">https://lists.internet2.edu/sympa/arc/shibboleth-users/2009-09/msg00226.html</a> <br clear="all"><font face="tahoma, sans-serif"><div>
<font face="tahoma, sans-serif"><br></font></div>Joshua Riffle</font><div><font face="tahoma, sans-serif">Software Engineer<br></font><div><font color="#CC0000" face="tahoma, sans-serif"><b>Azusa Pacific University</b></font></div>
</div><br>
<br><br><div class="gmail_quote">On Mon, Jul 23, 2012 at 12:09 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 7/23/12 3:05 PM, "Joshua Riffle" <<a href="mailto:jriffle@apu.edu">jriffle@apu.edu</a>> wrote:<br>
<br>
> Has anyone implemented a front-facing reverse proxy server with a<br>
>Shibboleth IDP server behind it? If so, what were the reasons for<br>
>implementing this model and how do you manage your SAML EndPoint not<br>
>matching the proxy server's URL?<br>
<br>
</div>Why would it be a requirement for them *not* to match? The whole point is<br>
that they have to, so I can tell you that nobody is doing that.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>