<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p><font face="monospace">That was it!!!</font></p>
<p><font face="monospace">Thank you so much, this was driving me
nuts...</font></p>
<p><font face="monospace">Regards</font></p>
<p><font face="monospace">Nicolas<br>
</font></p>
<p><font face="monospace"><br>
</font></p>
<div class="moz-cite-prefix">Le 15.12.23 à 16:18, GAMBINI Gilian via
users a écrit :<br>
</div>
<blockquote type="cite" cite="mid:8ae3982da3884c5da4c9e4f8028e81af@dsi.cnrs.fr">
<style type="text/css" style="display:none;">P {margin-top:0;margin-bottom:0;}</style>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, "EmojiFont", "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; --darkreader-inline-color: #e8e6e3;" data-darkreader-inline-color="">
<p>Hello<br>
<br>
I think your httpd receive http (no ssl) requests, shibd
refuse to evaluate them. Maybe you can try to set false to
handlerSSL parameter in shibboleth2.xml ->
ApplicationDefaults -> Session ?<br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions" class="OWAAutoLink moz-txt-link-freetext" moz-do-not-send="true">https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions</a><br>
<br>
Regards, Gilian.<br>
<br>
</p>
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size: 11pt; --darkreader-inline-color: #e8e6e3;" data-darkreader-inline-color="" face="Calibri, sans-serif" color="#000000"><b>De :</b> users
<a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.net"><users-bounces@shibboleth.net></a> de la part de nicolas
roggli via users <a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a><br>
<b>Envoyé :</b> vendredi 15 décembre 2023 15:51<br>
<b>À :</b> <a class="moz-txt-link-abbreviated" href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
<b>Cc :</b> nicolas roggli<br>
<b>Objet :</b> Setting shibboleth/apache behind nginx
reverse proxy</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt">
<div class="PlainText">Hi,<br>
<br>
I am trying to setup a shibboleth/apache authentication
behind an nginx <br>
server. Here below are my current nginx and apache config,
I just <br>
changed the domain names.<br>
<br>
I am quite confident that nginx passes the requests to
apache. When I <br>
access <a href="https://services.mydomain.ch" id="LPlnk246738" moz-do-not-send="true" class="moz-txt-link-freetext">https://services.mydomain.ch</a>,
it reaches the file defined in the
<br>
apache config (/var/www/staging/proxied/index.html) which
is different <br>
from the root defined in the nginx config.<br>
<br>
Accessing <a href="https://services.mydomain.ch/secure" moz-do-not-send="true" class="moz-txt-link-freetext">https://services.mydomain.ch/secure</a>
does try to authenticate,
<br>
as I receive an expected message stating<br>
<br>
> Unknown or Unusable Identity Provider<br>
><br>
> The identity provider supplying your login
credentials is not <br>
authorized for use with this service or does not support
the necessary <br>
capabilities.<br>
<br>
My problem, or one of, is that I cannot access <br>
<a href="https://services.mydomain.ch/Shibboleth.sso/Session" moz-do-not-send="true" class="moz-txt-link-freetext">https://services.mydomain.ch/Shibboleth.sso/Session</a>
which results in a
<br>
404 error. Apache logs the access, but no error except
the 404.<br>
127.0.0.1 - - [15/Dec/2023:15:33:03 +0100] "GET
/Shibboleth.sso/Session <br>
HTTP/1.0" 404 .....<br>
<br>
Any idea why I can't access /Shibboleth.sso/Session ?<br>
<br>
Any suggestions are welcomed and would be greatly
appreciated<br>
<br>
Nicolas<br>
<br>
----------------- nginx -----------------<br>
server {<br>
<br>
listen 80;<br>
listen [::]:80;<br>
<br>
server_name services.mydomain.ch;<br>
if ($host = services.mydomain.ch) {<br>
return 301 <a href="https://$host$request_uri" moz-do-not-send="true" class="moz-txt-link-freetext">https://$host$request_uri</a>;<br>
}<br>
}<br>
<br>
server {<br>
listen 443 ssl;<br>
listen [::]:443 ssl;<br>
<br>
server_name services.mydomain.ch;<br>
root /var/www/staging/test;<br>
<br>
access_log /var/log/nginx/services-access.log;<br>
error_log /var/log/nginx/services-error.log;<br>
<br>
index index.html;<br>
<br>
location / {<br>
proxy_set_header Host $host;<br>
proxy_set_header X-Forwarded-Host
$host:$server_port;<br>
proxy_set_header X-Forwarded-Server $host;<br>
proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;<br>
proxy_pass <a href="http://127.0.0.1:8081" moz-do-not-send="true" class="moz-txt-link-freetext">http://127.0.0.1:8081</a>;<br>
}<br>
<br>
location ~ /\.git {<br>
deny all;<br>
}<br>
<br>
ssl_certificate <br>
/etc/letsencrypt/live/services.mydomain.ch/fullchain.pem;
# managed by <br>
Certbot<br>
ssl_certificate_key <br>
/etc/letsencrypt/live/services.mydomain.ch/privkey.pem; #
managed by Certbot<br>
}<br>
<br>
----------------- apache -----------------<br>
<br>
<VirtualHost *:8081><br>
ServerAdmin webmaster@localhost<br>
DocumentRoot /var/www/staging/proxied<br>
<Location "/secure"><br>
AuthType shibboleth<br>
ShibRequestSetting entityID <br>
<a href="http://adfs.mydomain.ch/adfs/services/trust" moz-do-not-send="true" class="moz-txt-link-freetext">http://adfs.mydomain.ch/adfs/services/trust</a><br>
ShibRequestSetting requireSession true<br>
ShibUseHeaders On<br>
Require shibboleth<br>
Require valid-user<br>
</Location><br>
<br>
ErrorLog ${APACHE_LOG_DIR}/services-error.log<br>
CustomLog ${APACHE_LOG_DIR}/services-access.log
combined<br>
</VirtualHost><br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" moz-do-not-send="true" class="moz-txt-link-freetext">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div>
</span></font></div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
</body>
</html>