<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">I have multiple VMs running IIS behind a load-balancing reverse proxy, with SSL-offload at the load-balancer.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Regular users connect to [ <a href="https://vhost/">https://vhost/</a> ]. Firewalls would prevent end users from ever connecting directly via a host name.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">For troubleshooting (especially with non-prod servers, but regularly real user facing production systems), I will frequently connect directly to a specific VM over http (no SSL): [
<a href="http://hostA/">http://hostA/</a> ] or [ <a href="http://hostB">http://hostB</a> ].<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I'm having trouble configuring the Shibboleth SP to allow both cases simultaneously. I'm pretty sure the answer is "you'll have to connect directly over SSL, or swap out the configuration while troubleshooting if you need to inspect
plain-text traffic".<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I know I can't do this, because of the SSL-offload:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <Site id="1" name="vhost"><o:p></o:p></p>
<p class="MsoPlainText"> <Alias>hostA</Alias><o:p></o:p></p>
<p class="MsoPlainText"> <Alias>hostB</Alias><o:p></o:p></p>
<p class="MsoPlainText"> </Site><o:p></o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
<p class="MsoPlainText">So I have to specify scheme and port on the Site:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <Site id="1" name="vhost" scheme="https" port="443"><o:p></o:p></p>
<p class="MsoPlainText"> <Alias>hostA</Alias><o:p></o:p></p>
<p class="MsoPlainText"> <Alias>hostB</Alias><o:p></o:p></p>
<p class="MsoPlainText"> </Site><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Everyone is connecting to a single IIS Web Site. Setting up a second IIS Web Site wouldn't be very helpful for troubleshooting. (I'm not aware of any IIS option that lets me make a new IIS Web Site which truly just passes traffic onto
another IIS Web Site in a way that I expect to be seamless).<o:p></o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
<p class="MsoPlainText">I have looked at every bit of documentation I can find related to the RequestMapper and mailing list posts, and I don't think any level of flexibility I configure there is helpful- a scheme/port is about the incoming request, while the
scheme/port on the <Site> define where a user is headed to.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I haven't come up with any re-direct scheme that could be implemented by my hosts or my reverse proxy that would help.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If I could define a scheme/port at the <Alias> level, and it behaved the same way as the scheme/port at the <Site> level, that would be perfect. But a quick look at the source for isapi_shib.cpp makes it clear that this would be a straightforward
but non-trivial change, and it would introduce some complexity that apparently nobody but me wants.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Is there any configuration option (or redirect option I could implement outside Shibboleth) that I'm missing? Or do I just need to make my direct host connections over SSL, and swap configurations in non-prod cases where I want to inspect
traffic for troubleshooting?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks,<o:p></o:p></p>
<p class="MsoPlainText">Alex<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>