<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>We've set up a test IdP (v2.4.0) and SP (v2.5.3). All communication is front-channel. Authentication via UserPassword works as expected when we're configured with these hosts: browser, SP, IdP, LDAP server.</div>
<div> </div>
<div>We added another host with a reverse proxy in front of the IdP and reconfigured for it. The browser connects to the reverse proxy and follows the same sequence of redirects to /idp/Authn/UserPassword, but then authentication fails. login.jsp is not dispatched (thus not displayed), and idp-process.log shows "AuthenticationException: No user identified by login handler."</div>
<div> </div>
<div>Extracts from idp-process.log are in the attached file - the first extract was during a failed authentication (with the reverse proxy) and the second was during a successful one (without the reverse proxy).</div>
<div> </div>
<div>Our reconfiguration to use the reverse proxy involved only these changes:<br/>
* changed the host:port values in the entityID and SingleSignonService Location attributes in idp-metadata.xml on the IdP and SP<br/>
* changed the host:port value in the entityID in shibboleth2.xml on the SP<br/>
* changed the host:port values in the entityID in the Anonymous and DefaultRelyingParty provider attributes on the IdP<br/>
* changed the host name in the IdP's server.xml (Tomcat 6)</div>
<div> </div>
<div>The reverse proxy has ProxyPreserveHost On (httpd 2.4) to set the Host header sent to the IdP to the reverse proxy's FQDN.</div>
<div> </div>
<div>Thanks for any help you can offer.</div>
<div> </div>
</div></div></body></html>