title: SSL Configuration and then request redirect to JBOSS with httpd, modjk and openAM Fedlet for Single Sign On
body: <p><strong>SSL configurations are not working for httpd ModJk redirection to jboss Web Application that is integrated with OpenAM through fedlet saml2 approach for Single Sign On.</strong></p>
  <p>Since i am doing this for the first time, i am requesting for some help on this.  I am trying to enable SSL configuration for Java web application that integrated with OpenAM(version 11) through fedlet saml2 approach for Single Sign On. SSL Configuration done and then request redirect to JBOSS with httpd, modjk and openAM Fedlet for Single Sign On. In OpenAM(version 11) server console, I generated the fedlet by configuring https application URL and used the same conf folder inside our application for communicating with openAM ldap authentication. When i hit the app URL in browser, request is redirecting to OpenAM for ldap authentication and after verifying LDAP credentials, it is not logging into application.</p>
  <p><strong>Steps Followed:</strong></p>
  <pre>
  1   OpenAM deployed tomcat server is configured with SSL certificate using connector tag.
  2   By accessing openAM console, created IDP server name (https://auth.test.app.com:443).
  3   After that, i created fedlet in OpenAM for my web application by giving URL (https://auth.test.app.com:443/MyWebApplication)
  4   Web Application is configured with conf folder of fedlet that was generated and deployed into jboss servers
  5   openssl installed into apache httpd server and ssl configurations are made for ssl.conf,httpd.conf and modjk.conf files as specified in below (plz refer all configurations section provided below)
  6   I am able to access app URL(https://auth.test.app.com/MyWebApplication/) in browser only when i did put entry into my local machine /etc/hosts/ file but i am doing all these changes in unix box server(I should access URL in public internet but Not sure if i miss anything i am not able to access until i register in my local machine hosts file. With http option, i am able to access without registering domain in my local machine hosts file, when try to configure https, URLs is not accessible until I register domain in local hosts file).
  7   When i browse app URL https://auth.test.app.com/MyWebApplication/, It is redirecting to OpenAM server URL(https://auth.test.app.com/Signin/UI/Login) for ldap authentication. 
  8   After entering ldap credentials in OpenAM login URL, THEN it is not logging into my application using https protocol, it is breaking and no logs observed. The whole process is working fine when using HTTP protocol but it is failing when trying to configure HTTPS.
  
  </pre>
  <p><strong>Process Flow Diagram:</strong></p>
  <p><a href="https://i.stack.imgur.com/MLXHO.png" rel="nofollow noreferrer">Click Here To See Flow Diagram</a></p>
  <p><strong>Server Details:</strong></p>
  <pre><code>APP URLs       --&gt;  https://auth.test.app.com/MyWebApplication/, https://auth.test.app.com
  MOd jk server  --&gt;  10.xx.xxx.143
  OpenAM server  --&gt;  10.xx.xxx.152 (openAM console can be accessed using URL https://auth.test.app.com)
  Jboss_servers  --&gt;  10.xx.xxx.111, 10.xx.xxx.222
  </code></pre>
  <p><strong>All Configuration Files</strong></p>
  <pre><code>##----SSL.conf------##
  default values
  -------
  ----
  Listen 443 https
  &lt;VirtualHost _default_:443&gt;
  ServerName auth.test.app.com
  SSLProtocol all -SSLv2 -SSLv3
  SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA
  SSLCertificateFile &quot;/etc/apache2/2.2/server.crt&quot;
  SSLCertificateKeyFile &quot;/etc/apache2/2.2/server.pem&quot;
  #My Web application using ajp protol
  ProxyPass /* ajp://10.xx.xxx.111:443/MyWebApplication/
  ProxyPassReverse /* ajp://10.xx.xxx.111:443/MyWebApplication/
  &lt;Proxy *&gt;
  AddDefaultCharset off
  Order deny,allow
  Allow from all
  &lt;/Proxy&gt;
  #mounting jk property file
  JkMount /* worker
  &lt;/VirtualHost&gt;
  
  ##----httpd.conf--------##
  default values
  -------
  ----
  IncludeOptional conf.d/SSL.conf
  
  ##------modjk.conf--------##
  default values
  -------
  ----
  JkMountFile conf/UriWorkerMap.properties
  JkWorkersFile /etc/httpd/conf/worker.properties
  &lt;Location /jkstatus/&gt;
      JkMount statusmanager
      Order deny,allow
      Allow from all
  &lt;/Location&gt;
  
  ##----UriWorkerMap.proeperties---------##
  #APP Load Balancer
  /MyWebApplication=applb
  /MyWebApplication/*=applb
  
  #OpenAM Server
  /Signin=Signlb
  /Signin/*=Signlb
  
  ##----worker.properties-----------------##
  #Log
  workers.apache_log=/var/log/httpd
  #Worker List
  worker.list=applb,approute1,approute2,Signlb,status
  worker.status.type=status
  worker.approute1.type=lb
  worker.approute1.sticky_session=True
  worker.approute1.balance_workers=node1
  
  #Jboss Node1
  worker.node1.port=8009
  worker.node1.host=10.xx.xxx.111
  worker.node1.redirect=node2
  worker.node1.type=ajp13
  worker.node1.lbfactor=1
  
  #Jboss Node 2
  worker.approute2.type=lb
  worker.approute2.sticky_session=True
  worker.approute2.balance_workers=node2
  worker.node2.port=8009
  worker.node2.host=10.xx.xxx.222
  
  #OpenAM Server Route
  worker.node4.port=8009
  worker.node4.host=10.xx.xxx.152
  worker.node4.type=ajp13
  worker.node4.lbfactor=1
  
  worker.Signlb.type=lb
  worker.Signlb.sticky_session=True
  worker.Signlb.balance_workers=node4
                                                                                                                        
  
  
  ##----OpeanAM-Tomcat Connector----##
  &lt;Connector SSLEnabled=&quot;true&quot; acceptCount=&quot;100&quot; clientAuth=&quot;false&quot;
      disableUploadTimeout=&quot;true&quot; enableLookups=&quot;false&quot; maxThreads=&quot;25&quot;
      port=&quot;443&quot; keystoreFile=&quot;/path/jksfile/keystorefile.jks&quot; keystorePass=&quot;Password&quot;
      protocol=&quot;org.apache.coyote.http11.Http11NioProtocol&quot; scheme=&quot;https&quot;
      secure=&quot;true&quot;  sslProtocol=&quot;TLS&quot; redirectPort=&quot;8443&quot;/&gt;
      
  ##---JBOSS -connector--------------##
  &lt;connector name=&quot;https&quot; protocol= &quot;org.apache.coyote.http11.Http11NioProtocol&quot; scheme=&quot;https&quot; socket-binding=&quot;https&quot; secure=&quot;true&quot;&gt;
                          &lt;ssl name=&quot;jboss7_ssl&quot; password=&quot;Password&quot; certificate-key-file=&quot;/path/jksfile/keystorefile.jks&quot; protocol=&quot;TLSv1+TLSv1.1+TLSv1.2&quot;/&gt;
  &lt;/connector&gt;
  </code></pre>