<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; --darkreader-inline-color: #e8e6e3;" data-darkreader-inline-color="">
<p>Hello<br>
<br>
I think your httpd receive http (no ssl) requests, shibd refuse to evaluate them. Maybe you can try to set false to handlerSSL parameter in shibboleth2.xml -> ApplicationDefaults -> Session ?<br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions" class="OWAAutoLink">https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions</a><br>
<br>
Regards, Gilian.<br>
<br>
</p>
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt; --darkreader-inline-color: #e8e6e3;" data-darkreader-inline-color=""><b>De :</b> users <users-bounces@shibboleth.net> de la part de nicolas roggli via
users <users@shibboleth.net><br>
<b>Envoyé :</b> vendredi 15 décembre 2023 15:51<br>
<b>À :</b> users@shibboleth.net<br>
<b>Cc :</b> nicolas roggli<br>
<b>Objet :</b> Setting shibboleth/apache behind nginx reverse proxy</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt">
<div class="PlainText">Hi,<br>
<br>
I am trying to setup a shibboleth/apache authentication behind an nginx <br>
server. Here below are my current nginx and apache config, I just <br>
changed the domain names.<br>
<br>
I am quite confident that nginx passes the requests to apache. When I <br>
access <a href="https://services.mydomain.ch" id="LPlnk246738">https://services.mydomain.ch</a>, it reaches the file defined in the
<br>
apache config (/var/www/staging/proxied/index.html) which is different <br>
from the root defined in the nginx config.<br>
<br>
Accessing <a href="https://services.mydomain.ch/secure">https://services.mydomain.ch/secure</a> does try to authenticate,
<br>
as I receive an expected message stating<br>
<br>
> Unknown or Unusable Identity Provider<br>
><br>
> The identity provider supplying your login credentials is not <br>
authorized for use with this service or does not support the necessary <br>
capabilities.<br>
<br>
My problem, or one of, is that I cannot access <br>
<a href="https://services.mydomain.ch/Shibboleth.sso/Session">https://services.mydomain.ch/Shibboleth.sso/Session</a> which results in a
<br>
404 error. Apache logs the access, but no error except the 404.<br>
127.0.0.1 - - [15/Dec/2023:15:33:03 +0100] "GET /Shibboleth.sso/Session <br>
HTTP/1.0" 404 .....<br>
<br>
Any idea why I can't access /Shibboleth.sso/Session ?<br>
<br>
Any suggestions are welcomed and would be greatly appreciated<br>
<br>
Nicolas<br>
<br>
----------------- nginx -----------------<br>
server {<br>
<br>
listen 80;<br>
listen [::]:80;<br>
<br>
server_name services.mydomain.ch;<br>
if ($host = services.mydomain.ch) {<br>
return 301 <a href="https://$host$request_uri">https://$host$request_uri</a>;<br>
}<br>
}<br>
<br>
server {<br>
listen 443 ssl;<br>
listen [::]:443 ssl;<br>
<br>
server_name services.mydomain.ch;<br>
root /var/www/staging/test;<br>
<br>
access_log /var/log/nginx/services-access.log;<br>
error_log /var/log/nginx/services-error.log;<br>
<br>
index index.html;<br>
<br>
location / {<br>
proxy_set_header Host $host;<br>
proxy_set_header X-Forwarded-Host $host:$server_port;<br>
proxy_set_header X-Forwarded-Server $host;<br>
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;<br>
proxy_pass <a href="http://127.0.0.1:8081">http://127.0.0.1:8081</a>;<br>
}<br>
<br>
location ~ /\.git {<br>
deny all;<br>
}<br>
<br>
ssl_certificate <br>
/etc/letsencrypt/live/services.mydomain.ch/fullchain.pem; # managed by <br>
Certbot<br>
ssl_certificate_key <br>
/etc/letsencrypt/live/services.mydomain.ch/privkey.pem; # managed by Certbot<br>
}<br>
<br>
----------------- apache -----------------<br>
<br>
<VirtualHost *:8081><br>
ServerAdmin webmaster@localhost<br>
DocumentRoot /var/www/staging/proxied<br>
<Location "/secure"><br>
AuthType shibboleth<br>
ShibRequestSetting entityID <br>
<a href="http://adfs.mydomain.ch/adfs/services/trust">http://adfs.mydomain.ch/adfs/services/trust</a><br>
ShibRequestSetting requireSession true<br>
ShibUseHeaders On<br>
Require shibboleth<br>
Require valid-user<br>
</Location><br>
<br>
ErrorLog ${APACHE_LOG_DIR}/services-error.log<br>
CustomLog ${APACHE_LOG_DIR}/services-access.log combined<br>
</VirtualHost><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>