<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<span style="font-size: 13px;">Thank you Chris - this was extremely helpful. You stopped me from going down a dead end. I checked the Native error logs and found it was giving this error:</span>
<div><span style="font-size: 13px;"><br>
</span></div>
<div><span style="font-size: 13px;"> <b>ERROR Shibboleth.ISAPI [3820] isapi_shib: Unable to locate metadata for identity provider</b><br>
<br>
Which to me means a bad path tot he IdP metadata file, most likely. I then revisited the shibboleth.xml settings file and corrected the relative paths to /Metadata, /Session, etc. since they now have the reverse proxy-necessitated directory /content/in the
path. I added handlerURL=<b>/content/</b>Shibboleth.sso" to the Sessions element.</span></div>
<div><span style="font-size: 13px;"><br>
</span></div>
<div><span style="font-size: 13px;"> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
<b>handlerURL="/content/Shibboleth.sso"</b><br>
checkAddress="false" handlerSSL="true" cookieProps="https"><br>
<br>
Now if I browse to </span></div>
<div><span style="font-size: 13px;"><a href="https://proxyserver.com/content/Shibboleth.sso/Metadata">https://proxyserver.com/content/Shibboleth.sso/Metadata</a></span></div>
<div><span style="font-size: 13px;">I get this message from the IdP:</span></div>
<div><span style="font-size: 13px;"><br>
</span>
<div><span style="font-size: 13px;"><b>Error:Unable to complete request at this time. (Request was from an untrusted provider-31DE48E3C3946D8E) </b></span></div>
<div><span style="font-size: 13px;"><br>
</span></div>
<span style="font-size: 13px;">Which is a whole lot farther along than before. </span></div>
<div><span style="font-size: 13px;"><br>
</span></div>
<div><span style="font-size: 13px;">Now here is where I am confused still. The metadata.xml file in /etc/ was given me by my IdP, and was at least apparently working before I changed hostnames. The only locations it contains all refer to the IdP. So that is
the Identity Provider metadata, correct?</span></div>
<div><span style="font-size: 13px;"><br>
</span></div>
<div><span style="font-size: 13px;">I tried the endpoint ...</span><span style="font-size: 13px; ">/Shibboleth.sso/Metadata on another content server I have that is functional. That endpoint gives me what looks like it must be SP metadata. Is that xml file
entirely generated by Shibboleth according to some template? Or have I just not found the file yet? What controls what goes into that file? </span></div>
<div><span style="font-size: 13px;"><br>
</span></div>
<div><span style="font-size: 13px;"><br>
</span><br>
<span style="font-size: 13px;">Thank you very much for your help!</span></div>
<div><span style="font-size: 13px;"><br>
</span></div>
<div><span style="font-size: 13px;">Ellen<br>
______________________________</span><br>
<span style="font-size: 13px;">Ellen Meiselman</span><br>
<span style="font-size: 13px;">University of Michigan Health System</span><br>
<span style="font-size: 13px;">MLearning</span><br>
<span style="font-size: 13px;">NCRC</span><br>
<span style="font-size: 13px;">2800 Plymouth Rd. </span><br>
<span style="font-size: 13px;">Building 200, Rm 207</span><br>
<span style="font-size: 13px;">Ann Arbor, MI 48109-2800</span><br>
<span style="font-size: 13px;">E-Mail: <a href="mailto:emeiselm@umich.edu">emeiselm@umich.edu</a></span><br>
<span style="font-size: 13px;">Phone (734) 936-2334</span><br>
<br>
<span style="font-size: 13px;">On Aug 19, 2014, at 12:04 PM, Christopher Bongaarts <<a href="mailto:cab@umn.edu">cab@umn.edu</a>> wrote:</span><br>
<br>
<blockquote type="cite"><span style="font-size: 13px;">On 8/19/2014 10:38 AM, Meiselman, Ellen wrote:<br>
</span>
<blockquote cite="mid:399DB7BE-3C6A-4B44-9479-02193BC9CD2B@med.umich.edu" type="cite">
<span style="font-size: 13px;">I installed shibboleth on an IIS server - call it <a href="http://contentserver.com">contentserver.com</a>. Everything was working.<br>
<br>
Then we put that server behind an F5 reverse proxy - let's call its hostname "proxyserver.com" <br>
<br>
So now, pointing the browser to https://proxyserver.com will display content that is actually on https://contentserver.com<br>
<br>
How do I set up the SSL certs so shibboleth will work for requests that come in to https://proxyserver.com? I have only very basic knowledge of how to install and bind certs.<br>
<br>
Right now I can't get Shibboleth working again. The plugin is up and running but I can't get the appropriate metadata from the IDP because I can't give them the correct certificate - at least I don't *think* I can. I don't know how to install a certificate
that is for another hostname.<br>
<br>
</span></blockquote>
<span style="font-size: 13px;"><br>
Keep in mind that there are usually two sets of certificates in play here - an SSL certificate that is used to secure your HTTPS traffic, and a SAML encryption certificate that is used by Shibboleth.<br>
<br>
Your SSL certificate is configured in the web server (IIS GUI in your case). This is the one that you typically buy from a public certificate authority.<br>
<br>
The Shib certificate (and corresponding private key) is normally generated at installation time and lives in the Shib configuration directory alongside shibboleth2.xml. Default name "shib-sp.pem" I think. The certificate details are not used at all by the
Shib software - the server name, expiration, CA signatures etc. are all irrelevant. It is just used as a convenient way to carry a public key. The Shib certificate is the one that is included in your SP's metadata file (that you give to your IdP).<br>
<br>
Also in the SP metadata file are several SAML endpoints (the XML elements that contain a Location attribute). They tell the IdP how to direct SAML messages to your SP. If you've changed the publicly-facing name of the server, you'll also need to update these endpoints
so they contain the correct URLs (as viewed by the browser). Since you're on IIS, you'll also need to verify that your Site directives in your shibboleth2.xml file are correct.<br>
<br>
If you use the metadata generator endpoint (/Shibboleth.sso/Metadata), it will include the currently configured certificate and whatever virtual hostname was used to access it in the endpoints.<br>
<br>
In all likelihood, you've left your Shib certificates alone, so in theory the only thing you should need to do (on the Shib side) is change the Locations of the endpoints in your metadata, and ask the IdP to use the updated metadata.<br>
</span>
<div><span style="font-size: 13px;">-- </span></div>
<div><span style="font-size: 13px;">%% Christopher A. Bongaarts %% </span></div>
<span style="font-size: 13px;"><a href="mailto:cab@umn.edu">cab@umn.edu</a></span>
<div><span style="font-size: 13px;"> %%</span></div>
<div><span style="font-size: 13px;">%% OIT - Identity Management %% </span></div>
<span style="font-size: 13px;"><a href="http://umn.edu/~cab">http://umn.edu/~cab</a></span>
<div><span style="font-size: 13px;"> %%</span></div>
<div><span style="font-size: 13px;">%% University of Minnesota %% +1 (612) 625-1809 %%</span></div>
<span style="font-size: 13px;"><br class="Apple-interchange-newline">
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</span></blockquote>
<br>
</div>
<p>**********************************************************<br>
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues </p></body>
</html>