HSTS support

[Wilson, Bruce E.]

To me, that’s more a developer/tester thing than a user thing.  I wouldn’t want a user to _ever_ override a browser certificate warning when going to an IdP.  In fact, the monitoring I’m doing specifically throws an error if it runs into a certificate error when doing tests for things a user would see.  But I also live in a bit more paranoid world than some others.

I sometimes get these when I bypass the LB in doing some testing, so it would affect me and my development more so than I think it would end-users.  I’ve been working around this by enabling some hacks in /etc/hosts on my testing infrastructure to bypass DNS and point the DNS name to a specific server, rather than the LB, when I need to bypass the LB and test one particular server in the cluster.

============================================================
Bruce E. Wilson (wilsonbe at ornl.gov) 
Information Technology Services Division 
Oak Ridge National Laboratory 
(office) +1-865-574-6651



On Feb 18, 2015, at 12:42 PM, Christopher Bongaarts <cab at umn.edu> wrote:

> On 2/18/2015 11:38 AM, Ian Young wrote:
>> I was thinking about supporting HTTP Strict Transport Security on my IdP. I do this elsewhere and it's a fairly simple set-a-header operation in things like Apache.
> 
> Main thing keeping me away from it is that it prevents the user from 
> overriding the SSL warning if you try to connect directly to one server 
> behind a load balancer and the SSL cert does not contain the "real" 
> server name.
> 
> -- 
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
> 
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net