<div dir='auto'>Deirdre,<div dir="auto"><br></div><div dir="auto">I prefer to use layer 7 (application) load balancers for better stickiness. Others on the list will disagree with good reason and it really depends on use case.</div><div dir="auto"><br></div><div dir="auto">In most cases it doesn't matter that much. Some security, speed, and user experience tradeoffs, but nothing dramatic unless you have very specific requirements.</div><div dir="auto"><br></div><div dir="auto">Best,</div><div dir="auto">Nate.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Dec 9, 2019 11:38 PM, Deirdre Kirmis <Deirdre.Kirmis@asu.edu> wrote:<br type="attribution" /><br><br><html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">In the continuing saga of me trying to get shibboleth to work on AWS EC2 with a load balancer…I removed the load balancer and added redirect to https (and generated local SSL cert files and pointed to them in my ssl.conf) and shibboleth
is now working perfectly on my server.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So, my next question…for those of you that have gotten this working…did you use a network load balancer, or an application load balancer?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have been trying with an application LB and have been told that I probably need to use NLB.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Deirdre Kirmis<o:p></o:p></p>
<p class="MsoNormal">Technology Services<o:p></o:p></p>
<p class="MsoNormal">Arizona State University Library<o:p></o:p></p>
<p class="MsoNormal">480-965-7240<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Nate Klingenstein<br>
<b>Sent:</b> Tuesday, December 3, 2019 6:49 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: configuring shibboleth on AWS using ELB<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">It's hard to tell you without actually seeing your configuration, but the only other possible cause I can think of would be a badly misconfigured IdP initiated setup. If you're working with SP first, it's probably one of those two issues:
metadata or server misconfiguration.<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Dec 3, 2019, 8:59 AM Deirdre Kirmis <<a href="mailto:Deirdre.Kirmis@asu.edu">Deirdre.Kirmis@asu.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">In fact, everywhere that I have ServerName configured…I have it configured as
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__-253cdns-2520name-2520pointing-2520to-2520my-2520ELB-253e&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=A8Tymnrba7nWkUFW2RC0axu4YwlUMsQmgsyYm6sFrtg&s=jpJ0l3Xjk-tu2lRcaCW0qc7RC6Zgx5CisNfT2gRvzdU&e=" target="_blank">
https://<dns name pointing to my ELB></a>:443 <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Is that correct? Is there some other configuration that I missed?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Deirdre Kirmis<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Technology Services<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Arizona State University Library<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">480-965-7240<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Deirdre Kirmis
<br>
<b>Sent:</b> Tuesday, December 3, 2019 8:34 AM<br>
<b>To:</b> Nate Klingenstein <<a href="mailto:ndk@signet.id" target="_blank">ndk@signet.id</a>>; Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> RE: configuring shibboleth on AWS using ELB<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">So, I do already have the ServerName directive pointing to the CNAME record that I set up for the ELB, in all instances of “ServerName” in the config files (ie: httpd.conf, ssl.conf,
etc) .. those files are pointing to the DNS entry for the load balancer. Everywhere that I am referencing my site is using that domain.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Deirdre Kirmis<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Technology Services<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Arizona State University Library<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">480-965-7240<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Nate Klingenstein <<a href="mailto:ndk@signet.id" target="_blank">ndk@signet.id</a>>
<br>
<b>Sent:</b> Tuesday, December 3, 2019 6:48 AM<br>
<b>To:</b> Deirdre Kirmis <<a href="mailto:Deirdre.Kirmis@asu.edu" target="_blank">Deirdre.Kirmis@asu.edu</a>>; Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> RE: configuring shibboleth on AWS using ELB<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Deirdre,</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Yes, it will work fine. If you're using Apache, you need to virtualize the virtual host with the right directives, generally ServerName
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__loadbalancer.asu.edu-3A443&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=A8Tymnrba7nWkUFW2RC0axu4YwlUMsQmgsyYm6sFrtg&s=UkQd_pfmLQVgwJjm-rje5iaMJfIVrxXCU9MG7dZ2eyk&e=" target="_blank">
loadbalancer.asu.edu:443</a>, so that it "thinks" it's the load balancer AND your metadata needs to reflect this. You can do the same with the Site directive in IIS. Many SP's are deployed like this.</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">By virtualization, essentially, the web server needs to "think" it's the load balancer when examining inbound messages and generating outbound requests. That's all.</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Take care,</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Nate.</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">--------</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif;border:solid windowtext 1.0pt;padding:0in"><img border="0" width="100" height="100" style="width:1.0416in;height:1.0416in" id="m_-1269692420148439383_x005f_x0000_i1025" src="cid:image001.jpg@01D5A9B7.B0C83DC0" alt="Image removed by sender."></span><o:p></o:p></p>
<p><span style="font-size:13.5pt;font-family:"Arial",sans-serif">The Art of Access</span><span style="font-family:"Arial",sans-serif">
<strong><span style="font-family:"Arial",sans-serif">®</span></strong></span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Nate Klingenstein</span></strong><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> | Principal</span><o:p></o:p></p>
<p><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__www.signet.id_&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=oxsob7j1y3vX9QeB4paDRVnYCAe2xrCbfc-SpQ_3EIA&s=qsHfA-ki9jhfbeMNNPmQMlsuo0ok8Fl-vvNg0ZA43zQ&e=" target="_blank">https://www.signet.id/</a>
</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<blockquote style="border:none;border-left:solid #B0B0B7 1.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt">-----Original message-----<br>
<strong><span style="font-family:"Calibri",sans-serif">From:</span></strong> Deirdre Kirmis<br>
<strong><span style="font-family:"Calibri",sans-serif">Sent:</span></strong> Tuesday, December 3 2019, 6:26 am<br>
<strong><span style="font-family:"Calibri",sans-serif">To:</span></strong> Nate Klingenstein; Shib Users<br>
<strong><span style="font-family:"Calibri",sans-serif">Subject:</span></strong> Re: configuring shibboleth on AWS using ELB<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;color:black">Nate, thank you so much for your response. Yes, my instance is behind a load-balancer, but I have a DNS entry pointing to the ELB AWS
domain, which is what I am using for my SP address. What do you mean by "Get the virtualization on your instance to match ELB"? Will I be able to make this work?</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;color:black">Thank you!</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;color:black"> </span><o:p></o:p></p>
</div>
<div id="m_-1269692420148439383Signature">
<div id="m_-1269692420148439383divtagdefaultwrapper">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Deirdre Kirmis</span><o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Web Application Developer</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:#222222;background:white">Discovery Services</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:#222222;background:white">ASU </span><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Library</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Arizona State University </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">480-965-7240</span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="m_-1269692420148439383appendonsend">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="m_-1269692420148439383divRplyFwdMsg">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><strong><span style="font-family:"Calibri",sans-serif">From:</span></strong> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>>
on behalf of Nate Klingenstein <<a href="mailto:ndk@signet.id" target="_blank">ndk@signet.id</a>><br>
<strong><span style="font-family:"Calibri",sans-serif">Sent:</span></strong> Tuesday, December 3, 2019 2:11 AM<br>
<strong><span style="font-family:"Calibri",sans-serif">To:</span></strong> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<strong><span style="font-family:"Calibri",sans-serif">Subject:</span></strong> RE: configuring shibboleth on AWS using ELB<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<div>
<p><span style="font-family:"Arial",sans-serif">Deirdre,</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">> however in my server log I get an error that the attributes are null. When I try to "fetch" my site metadata, it just spins and never comes back as uploaded. When I manually upload the file, it acts like it
was successful, but when I try the test it says my site is not registered. What am I doing wrong?</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Sorry, in my haste, I missed this part of your message. It's most likely that your site is behind a load balancer(obviously) and SAMLtest can't issue queries directly to individual nodes behind a load balancer.
Even if it could, it would receive the wrong answer. Alternative possibilities exist, but this one looks pretty clear. Get the virtualization on your instance to match ELB and then type in ELB as your IdP address.</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">You'd eventually have to do this with any IdP, so this is far from a fruitless exercise.</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Take care,</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Nate.</span><o:p></o:p></p>
<blockquote style="border:none;border-left:solid #B0B0B7 1.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</blockquote>
</div>
</div>
</blockquote>
</div>
</div>
<p class="MsoNormal">-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=l45AxH-kUV29SRQusp9vYR0n1GycN4_2jInuKy6zbqQ&r=X1YAM2yWs1HIcWRXyPCSUtCKxhQO748y834uz5ZFnTY&m=A8Tymnrba7nWkUFW2RC0axu4YwlUMsQmgsyYm6sFrtg&s=cNNAL8FpSkt__hxvyMbySQTUW49PUJys9FcYr8dgGmk&e=" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>
<pre>-- <br>
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre>