sanity check : idp front end

[Cantor, Scott]

On 10/2/13 10:52 AM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>Looking for a sanity check on the idea of running a front end to the
>IdP primarily for the purpose of binding a privileged port as root, as
>an option when setuid is not desirable.

Interesting idea. Would be even cooler if they supported AJP proxying from
within Jetty itself.

>I think such a front end would be a transparent reverse tunneling
>proxy, but I really do not understand what happens to SSL/TLS on
>either side of the mitm, and I do not understand the implications.

There's really no such thing as a transparent reverse proxy, but they can
be workable if the applications are very careful about their design, which
is probably not an issue for us.

TLS is an optional choice, this would be proxying to localhost. Presumably
the port 8443 support would just be running native without the proxy,
which would still allow for client certificate authentication.

One problem is that with the proxy in front, you lose the ability to do
certificate authentication of *users* to the 443 port unless you proxy
that into basic-auth or something. That would be a potentially complicated
thing to deal with unless we just told people doing that to configure
setuid.

BTW, I concur with your assessment of Jetty 9, it's not settled. I was
looking at getting 9.0 running for my IdP and concluded they changed so
much in 9.1 that I'd just wait for it.

-- Scott