title: WIF passive federation with custom load balancer in place
body: <p>I'm implementing a simple load balancer - it's an http listener which parses incoming requests from browser and routes them to appropriate ASP.NET application. It listens on a certain port (8801) and when routing it preserves the original URI and changes only port number, e.g. <a href="https://machine.domain.com:8801/testsite/Default.aspx" rel="nofollow">https://machine.domain.com:8801/testsite/Default.aspx</a> could be routed to <a href="https://machine.domain.com:8811/testsite/Default.aspx" rel="nofollow">https://machine.domain.com:8811/testsite/Default.aspx</a></p>
  
  <p>With no security routing works just fine. The problem emerges when I try to apply WIF federation to the ASP.NET apps. I use ADFS 2.0. Here are two scenarios I tried:</p>
  
  <p>scenario 1</p>
  
  <p>relying party's WS-Federation passive endpoint is set to ASP.NET app URI</p>
  
  <p>When load balancer URI is accessed through browser, load balancer routes to the ASP.NET app and the page gets loaded, however, the RequestSecurityTokenResponse from STS is redirected directly to the ASP.NET app (not the load balancer), according to the passive endpoint set up. So it works but since I want the entire communication towards ASP.NET app to be handled through the load balancer, this scenario doesn't meet my requirement.</p>
  
  <p>scenario 2</p>
  
  <p>relying party's WS-Federation passive endpoint is set to load balancer URI</p>
  
  <p>When load balancer URI is accessed through browser, load balancer routes to the ASP.NET app, which returns Unauthorized response, browser redirects to STS, RequestSecurityTokenResponse is redirected back to the load balancer, but when further routed to the ASP.NET app, I get a response of 401 - Unauthorized: Access is denied due to invalid credentials.  That's due to the URI mismatch I believe, as the saml token is issued for load balancer URI. I tried various combinations of audience uris and realms, but no success.</p>
  
  <p>So my question is whether there exists a workaround that would enable load balancer handle all necessary federation communication, as my ASP.NET apps can only be accessed from the load balancer.</p>
  
  <p>I hope I explained my problem clearly enough.</p>
  
  <p>Help much appreciated
  Thanks</p>