<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">Le 30/07/2014 18:27, Marc Kalberer a
écrit :<br>
</div>
<blockquote cite="mid:53D91CFA.9030602@programmers.ch" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
Le 30/07/2014 18:05, Cantor, Scott a écrit :<br>
<blockquote cite="mid:CFFE8E53.53431%25cantor.2@osu.edu"
type="cite">
<pre wrap="">On 7/30/14, 11:46 AM, "Marc Kalberer" <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:info@programmers.ch"><info@programmers.ch></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">ProxyPass /Shibboleth.sso
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://www.leclimatentrenosmains.org/Shibboleth.sso/">https://www.leclimatentrenosmains.org/Shibboleth.sso/</a>
</pre>
</blockquote>
<blockquote type="cite">
<pre wrap="">ProxyPassReverse /Shibboleth.sso
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://www.leclimatentrenosmains.org/Shibboleth.sso/">https://www.leclimatentrenosmains.org/Shibboleth.sso/</a>
But ... no changes ....
</pre>
</blockquote>
<pre wrap="">I meant you have to *not* proxy them, but I don't have the most basic idea
what this system design looks like.
Now you're talking about a reverse proxy in front of the SP, and that's
much more difficult to do. At minimum you have to completely virtualize
all kinds of settings on the back-end because the SP has to believe it's
running on the front-end. The Apache ServerName in back has to virtualize
the scheme, host, and port to match the proxy. And the metadata for the SP
needs to reflect the fact that the client is talking to the proxy, not the
back-end. This is very advanced stuff.</pre>
</blockquote>
maybe I wrongly describe the environment.<br>
ServerName inside is "<a moz-do-not-send="true"
class="moz-txt-link-abbreviated"
href="http://www.leclimatentrenosmains.org">www.leclimatentrenosmains.org</a>"<br>
there is no name changes, or what ever.<br>
My ProxyPass test was wrongly mentionned, it was just to specify
that I tried many different configurations / solutions<br>
</blockquote>
Just to be sure no saying wsomething wrong I ask the provider to
test it internaly ( before the proxy) <br>
I got a <br>
Oui, je vous confirme. Par acquit de consience, j'ai même testé en
court-circuitant le reverse proxy :<br>
<br>
http7:~# curl -v 127.1.113.177:8080/Shibboleth.sso --header
"Location: <a class="moz-txt-link-abbreviated" href="http://www.leclimatentrenosmains.org">www.leclimatentrenosmains.org</a>"<br>
* About to connect() to 127.1.113.177 port 8080 (#0)<br>
* Trying 127.1.113.177... connected<br>
* Connected to 127.1.113.177 (127.1.113.177) port 8080 (#0)<br>
> GET /Shibboleth.sso HTTP/1.1<br>
> User-Agent: curl/7.21.0 (x86_64-pc-linux-gnu) libcurl/7.21.0
OpenSSL/0.9.8o zlib/1.2.3.3 libidn/1.8 libssh2/0.18<br>
> Host: 127.1.113.177:8080<br>
> Accept: */*<br>
> Location: <a class="moz-txt-link-abbreviated" href="http://www.leclimatentrenosmains.org">www.leclimatentrenosmains.org</a><br>
><br>
< HTTP/1.1 302 Moved Temporarily<br>
< Date: Wed, 30 Jul 2014 16:30:57 GMT<br>
< Server: Apache/2.2<br>
< Expires: Sun, 19 Nov 1978 05:00:00 GMT<br>
< Cache-Control: store, no-cache, must-revalidate, post-check=0,
pre-check=0<br>
< Set-Cookie:
SESSabebeedf35bb6c34586d08444bd78c3b=j11bnu7a0kggurnqmoogi0ds26r29nq1;
expires=Fri, 22-Aug-2014 20:04:17 GMT; path=/<br>
< Last-Modified: Wed, 30 Jul 2014 16:30:57 GMT<br>
< location: /node/6<br>
< Vary: Accept-Encoding<br>
< Content-Length: 0<br>
< Content-Type: text/html; charset=utf-8<br>
<<br>
* Connection #0 to host 127.1.113.177 left intact<br>
* Closing connection #0<br>
<blockquote cite="mid:53D91CFA.9030602@programmers.ch" type="cite">
<br>
<blockquote cite="mid:CFFE8E53.53431%25cantor.2@osu.edu"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I just asked the provider, he told me that his proxy is 100% transparent,
and he his absolutely sure that it could not intercept /Shibboleth.sso
</pre>
</blockquote>
<pre wrap="">I assumed the SP was on the front end. A proxy in front means there are a
lot of potential problems in play and there's not enough information to go
on to begin to suggest a fix.
-- Scott
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<b>Programmers.ch</b><br>
Développement WEB<br>
Solutions libres et Opensources<br>
Tel: ++41 76 44 888 72<br>
Site: <a moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.programmers.ch">http://www.programmers.ch</a><br>
</div>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<b>Programmers.ch</b><br>
Développement WEB<br>
Solutions libres et Opensources<br>
Tel: ++41 76 44 888 72<br>
Site: <a class="moz-txt-link-freetext" href="http://www.programmers.ch">http://www.programmers.ch</a><br>
</div>
</body>
</html>