Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In one environment, we have three servers load balanced that have a single Tomcat instance on each, fronted by two different Apache virtual hosts. Each of those two virtual hosts (served by all three servers) has its own different load balancer. Internally, the first host (we'll call it barfoo) is served by port 443 (HTTPS) with its cert and the second host (we'll call it foobar) is served by port 1443 (HTTPS). When you hit foobar, it goes to the load balancer which is using IP affinity for that host, so you can easily test login/HTTPS on one of the servers serving foobar, but not the others (because you keep getting that server for the lifetime of the LB session, iirc).

In addition, each of the servers are using Shibboleth v2 for authN/SSO, using mod_shib (iirc). So, a normal request to foobar hits the LB, is directed to the 3rd server (and will do that from then on for as long as the LB session lasts), then Apache, then to the Shibboleth SP which looks at the request, makes you login via negotiation with the Shibboleth IdP, then you hit Apache again which in turn hits Tomcat, renders, and returns the response. (I'm leaving out some steps there.)

We'd like to hit one of the individual servers ( which we'll say has IP via HTTPS (skipping the load balancer), so we at first try putting this in /etc/hosts:

But since is a secondary virtual host running on 1443, it attempts to get rather than at port 1443 and see that the cert for is invalid for this case since it doesn't match the request's host,

I thought an ssh tunnel might be easy enough, so I tried:

ssh -L

I tried just hitting https://localhost:7777/webappname in a browser, but when the Shibboleth login is over, it again tries to redirect to, which is the default host for 443, and we get into an infinite redirect loop.

I then tried setting up an SSH tunnel with privileged port 443 locally going to 443 of as the hostname for that virtual host:

sudo ssh -L

I also edited /etc/hosts to add:

This finally worked and I was able to get the browser to hit the individual HTTPS host at, bypassing the load balancer.

This was a bit of a pain and wouldn't work for everyone, due to the requirement to use the local 443 port and ssh to the server.

Is there an easier way to browse to and log into an individual host in this case?

share|improve this question

migrated from Mar 16 '11 at 16:08

This question came from our site for professional and enthusiast programmers.

up vote 0 down vote accepted

Scott Cantor suggested that webisoget's map command might be a good way of scripting access to individual Shibbolized apps on specific servers more simply, for monitoring, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.