<p>I am trying to configure shibboleth service provider in kubernetes environment.</p>

<p>In non-docker environment, apache2 and shibd services runs no the same server and apache2 communicates with shibd using mod_shib apache module (correct me if am wrong)</p>

<p>Is it possible to deploy shibboleth service provider in separate container and apache in separate container? If yes, has anyone done this already? Is there any docs?</p>

<p>As because I already have pods running my environment. One for apache and another one for java spring boot application. Apache acts as a reverse proxy for my java app.</p>

<p>Now I just want to deploy one more container for shibboleth, is it possible?</p>

karthikeayan
<p>Shibboleth must be installed inside apache itself. </p>

<p>So No, you cannot separate out shibboleth container out of apache container. </p>

<p>Your assumption is right, you apache communicates with mod_shib.</p>

<p>You have three options, </p>

<ol>
<li>Use readymade docker image for shibboleth - like <a href="https://hub.docker.com/r/unicon/shibboleth-sp" rel="nofollow noreferrer">this</a> one.</li>
</ol>

<p>Issue with this is, you need to setup everything else related to apache on your own for this one. </p>

<ol start="2">
<li>Use two separate apache instances , one for proxy pass and other for shibboleth installation. </li>
</ol>

<p>As you want to install shibboleth SP, you may try to proxy pass the secured location like <code>/secure</code> in reverse proxy apache to shibboleth installed apache. </p>

<p>This way you can separate out reverse proxy and shibboleth SP in separate container, but you may add little overhead for multiple proxies. However, I don't see too much overhead, though. </p>

<ol start="3">
<li>Build on your own. Use <a href="https://wiki.shibboleth.net/confluence/display/SP3/LinuxInstall" rel="nofollow noreferrer">this</a> steps.</li>
</ol>

<p>Shibboleth in linux is only out of box supported in RPM based distribution. 
You need to modify <code>shibboleth2.xml</code>. Add some metadata file or URL for IdP. Some certificates too. </p>

<p>You can mix this option with first two too. </p>
