Beware: Using UAG with an SSL decryptor in front

A quick beware: In UAG you set up your trunks as http or https - which is fine unless you have an SSL decryptor in front of the UAG server. Using this, you access the site using https, but the traffic is decrypted and reaches the server as http.
The problem here is that UAG uses HTTP 302 redirects extensively. However, the content of these are defined by whether the trunk is http or https and as such in the scenario above returns redirects with http links.
This means that (assuming your SSL decryptor cannot/does not rewrite those links for you), users directed to the http version of the site not the https, which completely breaks the site for the user.
The easy fix is to set up something that accepts those http requests and redirects users to the https site (I use my load balancer)
More complicated is to use AppWrap to rewrite the 302s - I will update when I test this
--Chris

(update below following MS answer:)

* Create the file c:\program files\Microsoft Forefront Unified Access Gateway\von\conf\websites\\conf\CustomUpdate\WhlFiltAppWrap_HTTP.xml (you may have to create the CustomUpdate folder)


* Paste the XML snippet below into it



==============START=================
<APP_WRAP ver="1.0" id="RemoteAccess_HTTPS.xml">
<MANIPULATION>
<HEADER_CHANGE>
<RESPONSE>
<APPLICATION>
<SERVER_NAME mask="">localhost</SERVER_NAME>
<PORT>6001</PORT>
<URL>
<URL_NAME>.*</URL_NAME>
<HEADER>
<NAME>Location</NAME>
<SAR>
<SEARCH encoding="">http://www.example.com</SEARCH>
<REPLACE encoding="">https://www.example.com</REPLACE>
</SAR>
</HEADER>
</EDIT>
</URL>
</APPLICATION>
</RESPONSE>
</HEADER_CHANGE>
</MANIPULATION>
</APP_WRAP>

===============END==================


* Activate UAG.

* You can still use appliciation manipulation tags in here if you have other AppWrap