Hi,<div><br></div><div>The only way to make it work is to have the same URL for the Proxy and the back-end server. You have to play on DNS to make it work</div><div>Everything is explained there:</div><div><a href="http://technet.microsoft.com/en-us/library/dd807055(v=ws.10).aspx">http://technet.microsoft.com/en-us/library/dd807055(v=ws.10).aspx</a> </div>
<div><br></div><div>Yannick<br><br><div class="gmail_quote">On Wed, Aug 15, 2012 at 7:38 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">>The problem is that the ADFS proxy (<a href="http://sso.a.example.com" target="_blank">sso.a.example.com</a>) requires the<br>
>"Destination" XML attribute be set to "<a href="http://adfs.a.example.com" target="_blank">adfs.a.example.com</a>".<br>
<br>
</div>That's a bug. The analagous scenario is a load balancer doing SSL<br>
offloading. Even though the back end server is at a different physical<br>
location, it must pretend to be the virtual location of the load balancer<br>
when it performs such comparisons. People screw this up with the SP and<br>
IdP all the time, because it's the web server's responsibility to do these<br>
adjustments.<br>
<br>
Note that IIS does not support those adjustments either, which is probably<br>
relevant to an ADFS situation.<br>
<br>
If MS supports a proxied scenario but does not support virtualizing the<br>
back end, you can't make it work.<br>
<div class="im"><br>
>The ADFS administrators says that the HTTP POST/Redirect URLs need to<br>
>be set to <a href="http://sso.a.example.com" target="_blank">sso.a.example.com</a> while the "Destination" AuthnRequest<br>
>attribute must be set to "<a href="http://adfs.a.example.com" target="_blank">adfs.a.example.com</a>". How can I achieve this?<br>
<br>
</div>You can't. Well, you could change the code (or add plugins that duplicate<br>
but tweak this value), but I'm ignoring that option.<br>
<br>
I could imagine some very ugly hacks such as an option to override the<br>
Destination value based on some kind of mapping table, but that's not<br>
implemented now.<br>
<div class="im"><br>
>How have other people interoperated with ADFS proxies?<br>
<br>
</div>I would imagine they have not. A page to document things that don't work,<br>
or how to work around issues is here:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/MicrosoftInterop" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/MicrosoftInterop</a><br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>