utsso/utsso-proxy repository overview

⁠What's this docker image?

utsso-proxy image is built on top of i2incommon/shibboleth_sp, with httpd reverse proxy configured. The built-in IDP is UofT's IdPz⁠.

⁠What URL is proxied?

Any URL except https://${HTTPS_HOST_NAME}/info is Proxyed to ${BACKEND_URL}.

⁠How SSO attributes are transferred to backend web servers?

• IDP sends SAML attributes in assertion
• Shib SP coverts them to env vars (/etc/shibboleth/attribute-map.xml)
• mod_proxy converts them to HTTP headers (/etc/httpd/conf.d/proxy.conf)

SSO attributes are transferred to backend servers via HTTP headers formated as UTSSO-Proxy-xxx. The xxx is the name configured in /etc/shibboleth/attribute-map.xml.

e.g.

UTSSO-Proxy-utorid: user01
UTSSO-Proxy-email: [email protected]

⁠Deploy model

utsso-proxy can work standalone or behind another proxy.

⁠standalone mode

client --(https)--> utsso-proxy --(http/ajp)--> app

⁠behind another proxy

client --(https)--> front-proxy --(http)--> utsso-proxy --(http/ajp)-->  app