Further IDP and Firefox Security Warning Message Questions

[Cantor, Scott E.]

On 8/3/11 10:41 AM, "Peterson, Tommy" <Tommy.Peterson at xpandcorp.com> wrote:

>I saw the discussion over the last few days about this and the advice
>involving artifacts etc. However, I was wondering if you could provide me
>more details on the suggested Tomcat configuration for the IDP where this
>is related.

Your IdP has no impact on the FF warning unless you stop using SSL there,
which I wouldn't really advise.

> 
>I never had this issue until we moved to the server with the load
>balancer, external domain names, and real SSL certificates.

You have the issue because your application is (incorrectly or not) using
http instead of https. All IdPs use SSL, as they should, so if you switch
you get the warning, or you switch to a SAML binding that doesn't trigger
it. Or you just deploy SSL on the SP side.

> 
>On the Shibboleth web site it says to configure the Tomcat server.xml
>file as follows:
><Connector port="8443"

That has nothing to do with the warning. That's the back channel port for
SOAP, the browser has no involvement. As Christopher said, your IdP is
broken if your client is accessing that port, it's not for browsers.

>But to avoid getting a blank white page in step 2 and 3 above (or even if
>I just try to get the Tomcat admin page by accessing
>http://(myIDPdomain):8443 with no errors in the Tomcat or IDP logs) I
>have had to adjust the above to

I suggest you don't do that and instead follow the documentation on how to
set up Tomcat. If the custom trust override doesn't work, then you
probably didn't put the jar file where the documentation says to. The log
will tell you that.

>So are the following Tomcat connector values required?

Yes. As is fixing the IdP and the metadata to make sure you have port 443
in use for browser facing access.

443 for clients, something else (8443 usually) for SOAP. Or decide you
don't need SOAP and drop the second port.

-- Scott