Further IDP and Firefox Security Warning Message Questions

[Peterson, Tommy]

I saw the discussion over the last few days about this and the advice involving artifacts etc. However, I was wondering if you could provide me more details on the suggested Tomcat configuration for the IDP where this is related.

I never had this issue until we moved to the server with the load balancer, external domain names, and real SSL certificates.

The process goes like this:


1)      I access this page:

 http://(mydomain)/drupal (no ssl or cert)


2)      The click "Log in" and the browser shows that URL changing to



https://(myIDPsdomain):8443/idp/Authn/UserPassword (ssl and cert and shows tomcat favicon illuminate)


3)      The user enters his userID/password and clicks login. Upon successful authentication the browser shows the URL changing to:

              https://(myIDPdomain):8443/idp/profile/SAML2/Redirect/SSO (ssl and cert and shows tomcat favicon illuminate)

            But the security window in Firefox shows up stating:
            Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party.
            Are you sure you want to continue sending this information?

          I can see that the page half loads. The browser favicon area illuminates with blue indicating it has the certificate but then the security warning shows pops up then if you click OK the Tomcat favicon appears in the blue area before moving on to step 4.


4)      I say OK and I am taken back to the protected service:

              http://(mydomain)/drupal/history


On the Shibboleth web site it says to configure the Tomcat server.xml file as follows:
<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11Protocol"
           SSLEnabled="true"
           scheme="https"
           clientAuth="true"
           keystoreFile="IDP_HOME/credentials/idp.jks"
           keystorePass="PASSWORD"
          SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation" />


But to avoid getting a blank white page in step 2 and 3 above (or even if I just try to get the Tomcat admin page by accessing http://(myIDPdomain):8443 with no errors in the Tomcat or IDP logs) I have had to adjust the above to
<Connector  port="8443"
                protocol="HTTP/1.1"
                SSLEnabled="true"
                maxThreads="150"
                scheme="https"
                secure="true"
                clientAuth="false"
                sslProtocol="TLS"
                keystoreFile="(path to my keystore)"
                keystorePass="(mykeystorepassword)" />


So are the following Tomcat connector values required? I have tried substituting them in my Connector one at a time and in combinations but they always cause the url to go to a blank white page.

*         SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"

*         protocol="org.apache.coyote.http11.Http11Protocol"

*         clientAuth="true"


Thanks.


________________________________
This message contains Devin Group confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.
Please notify the sender immediately by e-mail if you have received this e-mail in error and delete this e-mail from your system. E-mail transmissions cannot be guaranteed secure, error-free and information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or contain viruses. The sender therefore does not accept liability for errors or omissions in the contents of this message which may arise as result of transmission. If verification is required please request hard-copy version.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20110803/ce8e17f1/attachment-0001.html