<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Garamond;
panose-1:2 2 4 4 3 3 1 1 8 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">If your ALB is handling SSL for you, you need to tell Shibboleth to be okay with http. You need to set cookieProps to http and handlerSSL to false in shibboleth2.xml. You might also need to include the scheme and port in the Servername
directive in your webserver so that your server constructs https URLs even if the server thinks it’s a non-SSL server.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Amit Dongaonkar<br>
<b>Sent:</b> Thursday, March 10, 2022 1:23 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Shibboleth SP on EC2 ALB setup<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif">Hello group,<br clear="all">
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif">Wondering if anyone has set up Shibboleth SP to work on an EC2 instance behind an application load balancer (ALB) in AWS.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif">I am trying to make this setup work but am not able to. Withe ALB between the webserver/SP and the IdP(in our case AWS SSO) the workflow goes into a loop where the SP keeps requesting for an assertion
and the IdP keeps providing one.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif">Any help /pointers would be appreciated.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Garamond",serif">Thanks and Regards,<o:p></o:p></span></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p style="background-image:initial;background-position:initial;background-repeat:initial">
<b><span style="font-size:12.0pt">Amit Dongaonkar</span></b><span style="font-size:9.5pt"><o:p></o:p></span></p>
<p style="background-image:initial;background-position:initial;background-repeat:initial">
<span style="font-size:9.5pt"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>