<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="en-CH" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hi all,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I'm working on putting a website "secured" with Shibboleth SP3 on Kubernetes, with apache/mod_shibd and shibd running in separate containers and actually separate pods.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">For those not familiar with Kubernetes, this is similar to putting apache/mod_shibd on one server and shibd on another server in the same local network.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">However, at the time that I'm writing the shibboleth2.xml, I can't be sure about shibd's IP address. What I can rely on however is it's DNS address – that's the Kubernetes way (well, that or using APIs).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">But unfortunately, the TCPListener only accepts an "</span>IP address in decimal dotted notation<span lang="EN-US">" for the clientAddress, see [1].<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">The only real workaround is the call shibd from a script in which I first patch shibboleth2.xml, i.e. look up the DNS address (or make a lookup over one of the Kubernetes APIs) and save the IP address to the config file.
That may work, but it's far from ideal.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Would it be possible to enhance the TCPListener to accept a DNS address and have shibd do the lookup instead?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Sandro</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">[1] https://wiki.shibboleth.net/confluence/display/SP3/TCPListener<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<p class="MsoNormal">SWITCH <o:p></o:p></p>
<p class="MsoNormal">Sandro Mathys, Managed Applications, Software and Services<o:p></o:p></p>
<p class="MsoNormal">Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland <o:p></o:p></p>
<p class="MsoNormal">phone +41 44 268 15 15, direct +41 44 268 16 55<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">sandro.mathys@switch.ch, www.switch.ch<o:p></o:p></p>
</div>
</body>
</html>