<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi, I found some info on this, but what I did find fails for me.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have multiple SP nodes that work just fine-ish on my inside network as the redirects resolve no problem.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>But squeezing it through a single non-shib enabled VIP isn’t fun. I tried to reset all of the associations in the metadata to the VIP and reregistering against testshib.org, but then the fatal errors come after login. For now I have disabled the shib and the web application is working through the VIP just fine, so it is only the shib ping pong with the external idp that is causing me trouble.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is there a basic guide on how to setup shib SP on multiple hosts behind a firewall or proxy with NAT talking to an external idp? The notion of an internal idp is possible, but the requirement I have before me is a common external idp (not testshib.org) that multiple sites, each with multiple web servers behind load balanced entries need to access. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have done a lot of WiKi walking over the last few days, and there is tons of info, but it is just bits here and there. Someday I may find it, but there is still a lot of reading to do. I am hoping that someone else is doing just this with an external idp and has a rough guide to get it working.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><div class=MsoNormal align=center style='text-align:center'><span style='color:#1F497D'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='color:#1F497D'>William T. Musil</span></b><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Manager, Technical Services<o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='color:#1F497D'><br></span><b><span style='color:#006AA7'>LABVANTAGE</span></b><span style='color:#1F497D'> </span><b><span style='color:#999999'>Solutions, Inc.</span></b><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal style='text-autospace:none'><span style='color:#1F497D'>265 Davidson Avenue, Suite 220<br>Somerset, NJ 08873-4120 USA<br><br>Phone: 908-333-0111<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt;text-autospace:none'><span style='color:#1F497D'>Mobile: 908-531-0835<br>Fax: </span><span lang=EN style='color:#1F497D'>732-560-0121</span><span style='color:#1F497D'><br>Email: <a href="mailto:wmusil@labvantage.com?subject=Link%20from%20Signature"><span style='color:#1F497D'>wmusil@labvantage.com</span></a><br>Website: <a href="http://www.labvantage.com"><span style='color:#1F497D'>www.labvantage.com</span></a><br>Skype: <a href="skype:bmusil.lvs?chat"><span style='color:#1F497D'>bmusil.lvs</span></a><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>