# https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig

# RPM installations on platforms with a conf.d directory will
# result in this file being copied into that directory for you
# and preserved across upgrades.

# For non-RPM installs, you should copy the relevant contents of
# this file to a configuration location you control.

#
# Load the Shibboleth module.
#
LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so

#
# Turn this on to support "require valid-user" rules from other
# mod_authn_* modules, and use "require shib-session" for anonymous
# session-based authorization in mod_shib.
#
ShibCompatValidUser Off

#
# Ensures handler will be accessible.
#
<Location /Shibboleth.sso>
  AuthType None
  Require all granted
</Location>

#
# Used for example style sheet in error templates.
#
<IfModule mod_alias.c>
  <Location /shibboleth-sp>
    AuthType None
    Require all granted
  </Location>
  Alias /shibboleth-sp/main.css /usr/share/shibboleth/main.css
</IfModule>

#
# Configure the module for content.
#
# You MUST enable AuthType shibboleth for the module to process
# any requests, and there MUST be a require command as well. To
# enable Shibboleth but not specify any session/access requirements
# use "require shibboleth".
#
<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  require shib-session
</Location>



# Basic Apache configuration

<IfModule mod_alias.c>
  <Location /shibboleth-ds>
#    Allow from all
Require all granted
    <IfModule mod_shib.c>
      AuthType shibboleth
      ShibRequestSetting requireSession false
      require shibboleth
    </IfModule>
  </Location>
  Alias /shibboleth-ds/idpselect_config.js /etc/shibboleth-ds/idpselect_config.js
  Alias /shibboleth-ds/idpselect.js /etc/shibboleth-ds/idpselect.js
  Alias /shibboleth-ds/idpselect.css /etc/shibboleth-ds/idpselect.css
  Alias /shibboleth-ds/index.html /etc/shibboleth-ds/index.html
  Alias /shibboleth-ds/blank.gif /etc/shibboleth-ds/blank.gif
</IfModule>

<Location /shibboleth>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  # old setting?
  ShibRequireSession On
  ShibUseHeaders On
  ShibUseEnvironment On

 RewriteEngine On
 RewriteBase /

 #IDP PROV
 RewriteCond %{HTTP:Shib-Identity-Provider}  idp.prov.bz
 RewriteRule .* - [E=INFO_HTTP_SHIB_IDENTITY_PROVIDER:prov,NE]
 #IDP EGOV
 RewriteCond %{HTTP:Shib-Identity-Provider}  test-idp.egov.bz.it
 RewriteRule .* - [E=INFO_HTTP_SHIB_IDENTITY_PROVIDER:egov,NE]
 #IDP REG
 RewriteCond %{HTTP:Shib-Identity-Provider}  demo-idp.regione.taa.it
 RewriteRule .* - [E=INFO_HTTP_SHIB_IDENTITY_PROVIDER:reg,NE]

 RequestHeader set INFO_HTTP_REFERER "%{INFO_HTTP_SHIB_IDENTITY_PROVIDER}e"
 #RequestHeader add "SIAG_USERNAME" "%{INFO_HTTP_SHIB_IDENTITY_PROVIDER}e\%{uid}e"
 RequestHeader add "SU" "%{INFO_HTTP_SHIB_IDENTITY_PROVIDER}e:%{uid}e"

  require valid-user
</Location>

ProxyPass  /shibboleth-ds  !
ProxyPass  /shibboleth-sp  !
ProxyPass  /Shibboleth.sso !
ProxyPass  /secure         !

#<Location ~ "^(?!/[Ss]hibboleth)(.*)$" >
#  ProxyPass        http://localhost:5000/
#  ProxyPassReverse http://localhost:5000/
#</Location>

RequestHeader unset X-Forwarded-Host

ProxyPass        / http://localhost:5000/
ProxyPassReverse / http://localhost:5000/ 
