Jetty deployment

[Tom Zeller]

>> I'd love to see back-channel disabled by default. Most new IdP
>> deployments don't need it (and from a deployer's perspective,
>> back-channel is costly). As we continue to traverse the long-tail of
>> IdP deployment, I think we'll find that the majority of IdP
>> deployments do just fine on SAML2 only.
>
> I'd love to get to the point where disabling back-channel by default was practical. It causes pain we should be able to do without, at least until the next reason to use back-channel becomes prevalent.
>
> Today, though, I don't think even a new IdP in the UKf *can* really survive without it, so on balance I'd prefer to retain the V2 stance of enabling it by default.

Given conflicting defaults, we might consider providing backchannel
support as a Jetty module, and the installer could prompt whether to
enable|disable by copying an .ini file to the right place. Currently,
in our "monolithic" (because we provide jetty.xml) Jetty
configuration, toggling requires commenting|uncommenting XML, which is
kind of a pain to automate, for example, the HTTP connector.

As Scott sort-of said, we'd also need to provide our own HTTPS and SSL
modules as well, since Jetty's defaults are not altogether suitable
for our needs.