<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi, I am very new to Shibboleth and am attempting to configure it to work with Ping Identity as the IdP and Shibboleth as the SP inside of Google Cloud Platform (GCP) behind a GCP LB. Running Shibboleth 2 on
Linux and Apache 2.4<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The will be used to authenticate users for access to SAS which is configured as HTTPS and listening on Port 8343. The LB is listening on Port 443 and will pass data through while changing the target port to
8343 in order to reach the SAS web server.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">When we generate the SP metadata all URLS come out as
</span><a href="https://%3csaswebserver%3e:8343/"><span style="color:#1F497D;text-decoration:none">https://<saswebserver>:8343/</span></a><span style="color:#1F497D">....<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">If we use that metadata unchanged then the return posts from the IdP will be stopped at the LB since it is not listening on 8343.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">If we change the metadata to remove 8343 or change it to 443, then we can get through the LB, but, we get the following error…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">ERROR OpenSAML.MessageDecoder.SAML2POST [1]: POST targeted at (</span><a href="https://sascloud.com:443/Shibboleth.sso/SAML2/POST"><span style="color:#1F497D;text-decoration:none">https://sascloud.com:443/Shibboleth.sso/SAML2/POST</span></a><span style="color:#1F497D">),
but delivered to (</span><a href="https://sascloud.com:8343/Shibboleth.sso/SAML2/POST"><span style="color:#1F497D;text-decoration:none">https://sascloud.com:8343/Shibboleth.sso/SAML2/POST</span></a><span style="color:#1F497D">)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Note: the name of the GCP VM internal host name (i.e., the SAS Web server) is completely different from sascloud.com. sascloud.com is simply our external/public DNS name for the LB. The url is changed from
</span><a href="https://sascloud.com:443"><span style="color:#1F497D;text-decoration:none">https://sascloud.com:443</span></a><span style="color:#1F497D">/... to
</span><a href="https://%3csashostname%3e:8343/"><span style="color:#1F497D;text-decoration:none">https://<sashostname>:8343/</span></a><span style="color:#1F497D">.... by the LB backend as it is passed into GCP.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Is the httpd.conf ServerName directive the only way to control this behavior and get the target and destination names to match? Or is there a directive (or directives) that can be specified in Shibboleth2.xml
that can perform the translation and allow the authentication to work and allow the user to get to their SAS GUI?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks in advance for any guidance, Dennis<o:p></o:p></span></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
The information in this Internet Email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this Email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution
or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. When addressed to our clients any opinions or advice contained in this Email are subject to the terms and conditions expressed in any applicable governing The
Home Depot terms of business or client engagement letter. The Home Depot disclaims all responsibility and liability for the accuracy and content of this attachment and for any damages or losses arising from any inaccuracies, errors, viruses, e.g., worms, trojan
horses, etc., or other items of a destructive nature, which may be contained in this attachment and shall not be liable for direct, indirect, consequential or special damages in connection with this e-mail message or its attachment.<br>
</font>
</body>
</html>