<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  </head>
  <body>
    <p><font face="monospace">That was it!!!</font></p>
    <p><font face="monospace">Thank you so much, this was driving me
        nuts...</font></p>
    <p><font face="monospace">Regards</font></p>
    <p><font face="monospace">Nicolas<br>
      </font></p>
    <p><font face="monospace"><br>
      </font></p>
    <div class="moz-cite-prefix">Le 15.12.23 à 16:18, GAMBINI Gilian via
      users a écrit :<br>
    </div>
    <blockquote type="cite" cite="mid:8ae3982da3884c5da4c9e4f8028e81af@dsi.cnrs.fr">
      
      <style type="text/css" style="display:none;">P {margin-top:0;margin-bottom:0;}</style>
      <div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; --darkreader-inline-color: #e8e6e3;" data-darkreader-inline-color="">
        <p>Hello<br>
          <br>
          I think your httpd receive http (no ssl) requests,  shibd
          refuse to evaluate them. Maybe you can try to set false to
          handlerSSL parameter in shibboleth2.xml ->
          ApplicationDefaults -> Session ?<br>
          <a href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions" class="OWAAutoLink moz-txt-link-freetext" moz-do-not-send="true">https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions</a><br>
          <br>
          Regards, Gilian.<br>
          <br>
        </p>
        <div>
          <hr tabindex="-1" style="display:inline-block; width:98%">
          <div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size: 11pt; --darkreader-inline-color: #e8e6e3;" data-darkreader-inline-color="" face="Calibri, sans-serif" color="#000000"><b>De :</b> users
              <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.net"><users-bounces@shibboleth.net></a> de la part de nicolas
              roggli via users <a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a><br>
              <b>Envoyé :</b> vendredi 15 décembre 2023 15:51<br>
              <b>À :</b> <a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
              <b>Cc :</b> nicolas roggli<br>
              <b>Objet :</b> Setting shibboleth/apache behind nginx
              reverse proxy</font>
            <div> </div>
          </div>
        </div>
        <font size="2"><span style="font-size:10pt">
            <div class="PlainText">Hi,<br>
              <br>
              I am trying to setup a shibboleth/apache authentication
              behind an nginx <br>
              server. Here below are my current nginx and apache config,
              I just <br>
              changed the domain names.<br>
              <br>
              I am quite confident that nginx passes the requests to
              apache. When I <br>
              access <a href="https://services.mydomain.ch" id="LPlnk246738" moz-do-not-send="true" class="moz-txt-link-freetext">https://services.mydomain.ch</a>,
              it reaches the file defined in the
              <br>
              apache config (/var/www/staging/proxied/index.html) which
              is different <br>
              from the root defined in the nginx config.<br>
              <br>
              Accessing <a href="https://services.mydomain.ch/secure" moz-do-not-send="true" class="moz-txt-link-freetext">https://services.mydomain.ch/secure</a>
              does try to authenticate,
              <br>
              as I receive an expected message stating<br>
              <br>
               > Unknown or Unusable Identity Provider<br>
               ><br>
               > The identity provider supplying your login
              credentials is not <br>
              authorized for use with this service or does not support
              the necessary <br>
              capabilities.<br>
              <br>
              My problem, or one of, is that I cannot access <br>
              <a href="https://services.mydomain.ch/Shibboleth.sso/Session" moz-do-not-send="true" class="moz-txt-link-freetext">https://services.mydomain.ch/Shibboleth.sso/Session</a>
              which results in a
              <br>
              404  error. Apache logs the access, but no error except
              the 404.<br>
              127.0.0.1 - - [15/Dec/2023:15:33:03 +0100] "GET
              /Shibboleth.sso/Session <br>
              HTTP/1.0" 404 .....<br>
              <br>
              Any idea why I can't access /Shibboleth.sso/Session ?<br>
              <br>
              Any suggestions are welcomed and would be greatly
              appreciated<br>
              <br>
              Nicolas<br>
              <br>
              ----------------- nginx -----------------<br>
              server {<br>
              <br>
                   listen 80;<br>
                   listen [::]:80;<br>
              <br>
                   server_name services.mydomain.ch;<br>
                   if ($host = services.mydomain.ch) {<br>
                       return 301 <a href="https://$host$request_uri" moz-do-not-send="true" class="moz-txt-link-freetext">https://$host$request_uri</a>;<br>
                   }<br>
              }<br>
              <br>
              server {<br>
                   listen 443 ssl;<br>
                   listen [::]:443 ssl;<br>
              <br>
                   server_name services.mydomain.ch;<br>
                   root /var/www/staging/test;<br>
              <br>
                   access_log /var/log/nginx/services-access.log;<br>
                   error_log /var/log/nginx/services-error.log;<br>
              <br>
                   index index.html;<br>
              <br>
                   location / {<br>
                       proxy_set_header Host $host;<br>
                       proxy_set_header X-Forwarded-Host
              $host:$server_port;<br>
                       proxy_set_header X-Forwarded-Server $host;<br>
                       proxy_set_header X-Forwarded-For
              $proxy_add_x_forwarded_for;<br>
                       proxy_pass <a href="http://127.0.0.1:8081" moz-do-not-send="true" class="moz-txt-link-freetext">http://127.0.0.1:8081</a>;<br>
                   }<br>
              <br>
                   location ~ /\.git {<br>
                       deny all;<br>
                   }<br>
              <br>
                   ssl_certificate <br>
              /etc/letsencrypt/live/services.mydomain.ch/fullchain.pem;
              # managed by <br>
              Certbot<br>
                   ssl_certificate_key <br>
              /etc/letsencrypt/live/services.mydomain.ch/privkey.pem; #
              managed by Certbot<br>
              }<br>
              <br>
              ----------------- apache -----------------<br>
              <br>
              <VirtualHost *:8081><br>
                   ServerAdmin webmaster@localhost<br>
                   DocumentRoot /var/www/staging/proxied<br>
                   <Location "/secure"><br>
                       AuthType shibboleth<br>
                       ShibRequestSetting entityID <br>
              <a href="http://adfs.mydomain.ch/adfs/services/trust" moz-do-not-send="true" class="moz-txt-link-freetext">http://adfs.mydomain.ch/adfs/services/trust</a><br>
                       ShibRequestSetting requireSession true<br>
                       ShibUseHeaders On<br>
                       Require shibboleth<br>
                       Require valid-user<br>
                   </Location><br>
              <br>
                   ErrorLog ${APACHE_LOG_DIR}/services-error.log<br>
                   CustomLog ${APACHE_LOG_DIR}/services-access.log
              combined<br>
              </VirtualHost><br>
              <br>
              -- <br>
              For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" moz-do-not-send="true" class="moz-txt-link-freetext">
                https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
              To unsubscribe from this list send an email to
              <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
            </div>
          </span></font></div>
      <br>
      <fieldset class="moz-mime-attachment-header"></fieldset>
    </blockquote>
  </body>
</html>