<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Besides what Scott and Nate have touched on, also be sure you are running a version/distribution of the Shibboleth SP meant for the specific OS base you are using on your AWS instances. I’ve seen folks try to use a CentOS rpm for the SP on Amazon Linux, and that will not lead to good things. As Scott said, really no reason not to still use TLS from the ELB to your instances, but if you choose not to, you’ll still want to “virtualize” on the web server side so the SP will still understand that HTTPS is being used to get to it.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Nov 25, 2019, at 6:54 PM, Nate Klingenstein <<a href="mailto:ndk@signet.id" class="">ndk@signet.id</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">Deirdre,</div><p style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class=""> </p><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">For what it's worth, we've configured a lot of IdP's and SP's in AWS, including SAMLtest. It's pretty straightforward: ELB, target groups, and instances, just wired together properly. There's really nothing special about it.</div><p style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class=""> </p><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">I often do it for single instances just because I like having ELB in between the world and me. It doesn't really provide anything that security groups wouldn't other than IP address obfuscation, so it's more of a security blanket than a necessary piece of infrastructure, but hey.</div><p style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class=""> </p><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">Take care,</div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;" class="">Nate.</div><p style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""> </p><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class="">--------</div><p style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""> </p><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""><img src="https://www.signet.id/wp-content/uploads/2019/08/signature-e1566142203123.png" class=""></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""><font size="4" class="">The Art of Access</font><span class="Apple-converted-space"> </span><strong class="">®</strong></div><p style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""> </p><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""><font size="2" class=""><strong class="">Nate Klingenstein</strong><span class="Apple-converted-space"> </span>| Principal</font></div><div style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""><font size="2" class=""><a href="https://www.signet.id/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">https://www.signet.id/</a></font></div><p style="caret-color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small; margin: 0px;" class=""> </p><blockquote style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; border-left-width: 2px; border-left-style: solid; border-left-color: rgb(176, 176, 183); margin-left: 5px; margin-right: 0px; padding-left: 5px;" class="">-----Original message-----<br class=""><strong class="">From:</strong><span class="Apple-converted-space"> </span>Deirdre Kirmis<br class=""><strong class="">Sent:</strong><span class="Apple-converted-space"> </span>Monday, November 25 2019, 4:30 pm<br class=""><strong class="">To:</strong><span class="Apple-converted-space"> </span><a href="mailto:users@shibboleth.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">users@shibboleth.net</a><br class=""><strong class="">Subject:</strong><span class="Apple-converted-space"> </span>configuring shibboleth on AWS using ELB<br class=""><br class=""><div class="bodyclass"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hi all…prefacing this to say that I am new to AWS and new to configuring shibboleth. I was wondering if anyone has successfully configured shibboleth on an AWS instance that is running https via a load balancer. I installed and configured shib, send/received metadata from my IDP, but when I generate my metadata file, the certs are not included, and the sp-cert.pem and sp-key.pem files did not get created. Do I still need to “configure” https locally on the server, and if so, how, and how do I fix my shib config?</div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </p><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks for any help!</div><p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;"> </p></div></div><pre class="">--
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">users-unsubscribe@shibboleth.net</a></pre></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""> <br class="webkit-block-placeholder"></div><hr style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><p style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">This email has been scanned for spam and viruses by Proofpoint Essentials. Click<span class="Apple-converted-space"> </span><a href="https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1574729663-YtXmZOv0bZni&r_address=mgrady%40unicon.net&report=1" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">here</a><span class="Apple-converted-space"> </span>to report this email as spam.</p><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">For Consortium Member technical support, see<span class="Apple-converted-space"> </span></span><a href="https://wiki.shibboleth.net/confluence/x/coFAAg" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div>--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div class=""><br class=""></div></div><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>