<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Le 30/07/2014 18:05, Cantor, Scott a écrit :<br>
<blockquote cite="mid:CFFE8E53.53431%25cantor.2@osu.edu" type="cite">
<pre wrap="">On 7/30/14, 11:46 AM, "Marc Kalberer" <a class="moz-txt-link-rfc2396E" href="mailto:info@programmers.ch"><info@programmers.ch></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">ProxyPass /Shibboleth.sso
<a class="moz-txt-link-freetext" href="https://www.leclimatentrenosmains.org/Shibboleth.sso/">https://www.leclimatentrenosmains.org/Shibboleth.sso/</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">ProxyPassReverse /Shibboleth.sso
<a class="moz-txt-link-freetext" href="https://www.leclimatentrenosmains.org/Shibboleth.sso/">https://www.leclimatentrenosmains.org/Shibboleth.sso/</a>
But ... no changes ....
</pre>
</blockquote>
<pre wrap="">
I meant you have to *not* proxy them, but I don't have the most basic idea
what this system design looks like.
Now you're talking about a reverse proxy in front of the SP, and that's
much more difficult to do. At minimum you have to completely virtualize
all kinds of settings on the back-end because the SP has to believe it's
running on the front-end. The Apache ServerName in back has to virtualize
the scheme, host, and port to match the proxy. And the metadata for the SP
needs to reflect the fact that the client is talking to the proxy, not the
back-end. This is very advanced stuff.</pre>
</blockquote>
maybe I wrongly describe the environment.<br>
ServerName inside is "<a class="moz-txt-link-abbreviated" href="http://www.leclimatentrenosmains.org">www.leclimatentrenosmains.org</a>"<br>
there is no name changes, or what ever.<br>
My ProxyPass test was wrongly mentionned, it was just to specify
that I tried many different configurations / solutions<br>
<br>
<blockquote cite="mid:CFFE8E53.53431%25cantor.2@osu.edu" type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I just asked the provider, he told me that his proxy is 100% transparent,
and he his absolutely sure that it could not intercept /Shibboleth.sso
</pre>
</blockquote>
<pre wrap="">
I assumed the SP was on the front end. A proxy in front means there are a
lot of potential problems in play and there's not enough information to go
on to begin to suggest a fix.
-- Scott
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<b>Programmers.ch</b><br>
Développement WEB<br>
Solutions libres et Opensources<br>
Tel: ++41 76 44 888 72<br>
Site: <a class="moz-txt-link-freetext" href="http://www.programmers.ch">http://www.programmers.ch</a><br>
</div>
</body>
</html>