<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Dear all,<br>
we have been running a service provider with nginx for years but now
we want to change the setup and I would like to hear your
experience.<br>
<br>
The publicly accessible machine will be a simple load
balancer/reverse proxy with nginx running e.g., <b>vm-front</b>.<br>
There are many services with some protected by Shibboleth running on
different virtual machines e.g., <b>vm-service1, vm-service2 </b>proxied
from vm-front.<br>
One internal virtual machine e.g., <b>vm-shib</b> would be
dedicated for Shibboleth again proxied from vm-front.<br>
<br>
The difference to the current setup is that Shibboleth will not be
running on vm-front anymore but on an internal dedicated virtual
machine (not publicly accessible but with internet access).<br>
<br>
Current nginx configuration:<br>
<br>
<blockquote><tt>291 # FastCGI authorizer for Auth Request module</tt><tt><br>
</tt><tt>292 location = /shibauthorizer {</tt><tt><br>
</tt><tt>293 internal;</tt><tt><br>
</tt><tt>294 include fastcgi_params;</tt><tt><br>
</tt><tt>296 fastcgi_pass 127.0.0.1:12344;</tt><tt><br>
</tt><tt>297 }</tt><tt><br>
</tt><tt>298</tt><tt><br>
</tt><tt>299 # FastCGI responder</tt><tt><br>
</tt><tt>300 location /Shibboleth.sso {</tt><tt><br>
</tt><tt>301 include fastcgi_params;</tt><tt><br>
</tt><tt>303 fastcgi_pass 127.0.0.1:12345;</tt><tt><br>
</tt><tt>304 }</tt><tt><br>
</tt><tt>305</tt><tt><br>
</tt><tt>306 # Resources for the Shibboleth error pages</tt><tt><br>
</tt><tt>307 location /shibboleth-sp {</tt><tt><br>
</tt><tt>308 alias
/opt/shibboleth-sp-fastcgi/share/shibboleth/;</tt><tt><br>
</tt><tt>309 }</tt><tt><br>
</tt><tt><br>
</tt></blockquote>
With some services protected like this<br>
<blockquote><tt> location = /clarin-sp-aggregator/aa-statistics.php
{</tt><br>
<tt> include shibboleth_auth;</tt><br>
<tt> include process_php;</tt><br>
<tt> }</tt><br>
</blockquote>
where the important parts of shibboleth_auth being<br>
<blockquote><tt>shib_request /shibauthorizer;</tt><tt><br>
</tt><tt>shib_request_use_headers on;</tt><br>
</blockquote>
<br>
For the record, we also use various RequestMaps<br>
<blockquote><tt> <RequestMapper type="XML"></tt><br>
<tt> <RequestMap></tt><br>
<tt> <Host name="lindat.mff.cuni.cz"</tt><br>
<tt> authType="shibboleth"</tt><br>
<tt> requireSession="true"</tt><br>
<tt> exportAssertion="true"</tt><br>
<tt> redirectToSSL="443"></tt><br>
<tt> <Path name="services"></tt><br>
</blockquote>
<br>
Has anyone experience with the desired setup and is there anything
we should be aware of?<br>
<br>
Thank you all.<br>
<br>
Regards,<br>
Jozef Misutka<br>
LINDAT/CLARIN <br>
<a class="moz-txt-link-freetext" href="http://lindat.cz">http://lindat.cz</a><br>
</body>
</html>