idp on port 80 only ?

[Paul Hethmon]

On 4/18/13 1:13 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 4/18/13 1:07 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:
>
>>Is it reasonable to run an idp on port 80 only and not 443 ?
>>
>>Maybe endpoints like https://idp.example.org:80/...
>>
>>I was thinking about clustering and the cloud, and it looks like most
>>cloud providers charge extra for https, since virtualizing it is
>>apparently non-trivial, and I was wondering if the idp could provide
>>communication security over port 80.
>
>Possible, yes, reasonable, probably not so much, it's the sort of thing
>people frown on. It's why the whole separate port thing for TLS was kind
>of viewed as a mistake vs. using startTLS.

But I will chime in and say that I run most of mine on port 80. In the
real estate vertical, very few sites implement SSL, so my customers would
rather run on port 80 than answer phone calls and explain to their members
why they get a security warning when going from an IdP on SSL to an
application that is not.

Paul