<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 8/19/2014 10:38 AM, Meiselman, Ellen
wrote:<br>
</div>
<blockquote
cite="mid:399DB7BE-3C6A-4B44-9479-02193BC9CD2B@med.umich.edu"
type="cite">
<div style="font-size: 16px; ">I installed shibboleth on an IIS
server - call it
<a moz-do-not-send="true" href="http://contentserver.com">contentserver.com</a>.
Everything was working.</div>
<div style="font-size: 16px; "><br>
</div>
<div style="font-size: 16px; ">Then we put that server behind an
F5 reverse proxy - let's call its hostname "<a
moz-do-not-send="true" href="http://proxyserver.com">proxyserver.com</a>" </div>
<div style="font-size: 16px; "><br>
</div>
<div style="font-size: 16px; ">So now, pointing the browser to <b><a
moz-do-not-send="true" href="https://proxyserver.com">https://proxyserver.com</a></b>
will display content that is actually on
<a moz-do-not-send="true" href="https://contentserver.com">https://contentserver.com</a></div>
<div style="font-size: 16px; "><br>
</div>
<div style="font-size: 16px; ">How do I set up the SSL certs so
shibboleth will work for requests that come in to
<a moz-do-not-send="true" href="https://proxyserver.com?">https://proxyserver.com?</a>
I have only very basic knowledge of how to install and bind
certs.</div>
<div style="font-size: 16px; "><br>
</div>
<div style="font-size: 16px; ">Right now I can't get Shibboleth
working again. The plugin is up and running but I can't get the
appropriate metadata from the IDP because I can't give them the
correct certificate - at least I don't *think* I can. I don't
know how to install a certificate that is for another hostname.</div>
<div style="font-size: 16px; "><br>
</div>
</blockquote>
<br>
Keep in mind that there are usually two sets of certificates in play
here - an SSL certificate that is used to secure your HTTPS traffic,
and a SAML encryption certificate that is used by Shibboleth.<br>
<br>
Your SSL certificate is configured in the web server (IIS GUI in
your case). This is the one that you typically buy from a public
certificate authority.<br>
<br>
The Shib certificate (and corresponding private key) is normally
generated at installation time and lives in the Shib configuration
directory alongside shibboleth2.xml. Default name "shib-sp.pem" I
think. The certificate details are not used at all by the Shib
software - the server name, expiration, CA signatures etc. are all
irrelevant. It is just used as a convenient way to carry a public
key. The Shib certificate is the one that is included in your SP's
metadata file (that you give to your IdP).<br>
<br>
Also in the SP metadata file are several SAML endpoints (the XML
elements that contain a Location attribute). They tell the IdP how
to direct SAML messages to your SP. If you've changed the
publicly-facing name of the server, you'll also need to update these
endpoints so they contain the correct URLs (as viewed by the
browser). Since you're on IIS, you'll also need to verify that your
Site directives in your shibboleth2.xml file are correct.<br>
<br>
If you use the metadata generator endpoint
(/Shibboleth.sso/Metadata), it will include the currently configured
certificate and whatever virtual hostname was used to access it in
the endpoints.<br>
<br>
In all likelihood, you've left your Shib certificates alone, so in
theory the only thing you should need to do (on the Shib side) is
change the Locations of the endpoints in your metadata, and ask the
IdP to use the updated metadata.<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>