You will find your answers in any of the numerous threads on "load balancing" your IdP found in the list archives<br><br><br><br>Joshua Riffle <jriffle@apu.edu> wrote:<br><br>Hi Scott,<div> Could you clarify what you mean by "virtualize"? Also, is there any existing wiki documentation for successful implementation of Shibboleth IDP and Reverse Proxy (I have yet to find any)? I read through Apache documentation for the ServerName directive and I see that you can specify the schema (HTTPS) and then it should get passed on the the ProxyPass argument with the correct URL rather than needing to setup SSL communication between the front-facing and back-end servers though I don't mind keeping the extra layer of secure communications as it is now. I don't wish to be frustrating to you but I would love to have a good grasp on best practices for our instance of Shibboleth so I'm looking forward to any advice from you.<br clear="all">
<font face="tahoma, sans-serif"><div><font face="tahoma, sans-serif"><br></font></div>Joshua Riffle</font><div><font face="tahoma, sans-serif">Software Engineer<br></font><div><font color="#CC0000" face="tahoma, sans-serif"><b>Azusa Pacific University</b></font></div>
</div><br><div class="gmail_quote">On Tue, Jul 24, 2012 at 1:06 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>On 7/24/12 1:55 PM, "Joshua Riffle" <<a href="mailto:jriffle@apu.edu" target="_blank">jriffle@apu.edu</a>> wrote:<br>
><br>
>Under normal circumstances we use SSL encryption at the front-facing<br>
>server and clear text communication to the proxied host because it's<br>
>already in a safe sandbox but even with<br>
>ProxyPreserveHost turned on Shib recognizes that the endpoint URL is HTTP<br>
</div>>when it arrives at <a href="http://shib.example.edu" target="_blank">shib.example.edu</a> <<a href="http://shib.example.edu" target="_blank">http://shib.example.edu</a>> and not<br>
<div>>HTTPS which it expects (causing a SAML EndPoint URL mismatch). So it was<br>
>necessary to setup SSL communication between the front-facing server and<br>
>its proxied host in order to mimic the HTTPS URL and match the expected<br>
>EndPoint URL for SAML.<br>
<br>
</div>That's what happens when you *don't* virtualize and instead use a<br>
rewriting proxy. If you want it to work as intended, you have to<br>
virtualize the back end. See ServerName in the Apache documentation<br>
amongst the other related commands.<br>
<div><div><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>