Authentication of reverse proxy

Question

Let's say there is an application server that runs multiple web applications. Some of these applications are accessible directly from the Internet, however a specific application requires single-sign-on, which is implemented via a reverse proxy solution that adds the proper HTTP headers. This reverse proxy implementation is running on a different box inside the company network. What are the typical ways to enforce that this particular application only processes request that are "through the SSO" (through the reverse proxy), but not the ones coming directly from the internet?

Some ideas:

• Simply check the request IP and see if that matches the proxy's
• Require an SSL client sertificate to be sent by the reverse proxy
• Do not care about the source of the incoming HTTP request, but check with the SSO if the HTTP headers included are for a valid SSO session or not

What are the pros and cons of each approach? How did you implement something similar? The particular SSO implementation is IBM WebSeal, but I'm also interested in how you've solved the problem with any other product as well. thanks!

Answer 1

From a networking perspective, the app that requires access only from your reverse proxy should ideally be running on a system (internal subnet/vlan) not accessible from the Internet directly. In fact, my preference would be to have all the apps behind the load balancer so that there is no direct path to the servers. If the app is tied to the code base used for all apps, you might be able to duplicate all the apps on an internal system that effectively only runs the SSO site (since it only receives those requests from the reverse proxy) and somehow render the SSO-site on the directly accessible system useless.

Another viable solution is to have an ACL on the site so that only the load-balancer can make requests to the app.

A solution not viable from a security POV would be to have public and private subnets mixed on your web host for handling your two use-cases.