Further IDP and Firefox Security Warning Message Questions

[Christopher Bongaarts]

Paul Hethmon wrote:
> Tommy,
> 
> How you expose your IdP or SP is totally up to you. What is being said
> here is that the well known port for HTTPS (HTTP over SSL) is port 443.
> That's not required, but is the IANA registered port assignment. Tomcat,
> as a standalone web server, sets its default port for HTTPS to 8443. If
> you wanted to run Tomcat as a web server using HTTPS, then you would
> typically change that connector to port 443.

And in the case where you (Tommy, not Paul) are doing SSL termination at 
a loadbalancer, you could change the port to 80 (to reduce confusion), 
or whatever port your loadbalancer ends up sending the traffic to.  In 
that case, you don't configure SSL there at all.

> For Shibboleth back channel, meaning attribute query from an SP to your
> IdP, then you would use 8443. The reason for the difference is that
> Shibboleth owns the TLS/SSL trust in that connection. So it's not just SSL
> there, it's using SSL to negotiate mutual trust between the SP and the IdP.

This also means that your load balancer MUST NOT do SSL offloading for 
the backchannel port (8443).  It should just pass the traffic through 
as-is and let Tomcat handle the SSL negotiation (with the extra 
connector configuration to use the IDP's keystore instead of the 
publicly-facing cert's keystore for port 443, and the special 
delegate-to-app SSL handler class).

So, summary for your situation (loadbalancer in front of IdP), the load 
balancer is listening on two ports, 443 and 8443.

On port 443, the LB does SSL offloading and routes requests to the real 
server's port 80.  It uses the publicly facing certificate (signed by a 
"real" CA).

On port 8443, the LB does NOT do SSL offloading, and routes requests to 
the real server's port 8443.

Tomcat is configured to listen on two ports, 80 and 8443.  On port 80 
there is no SSL.  On port 8443 Tomcat is set up with the special 
backchannel SSL configuration, with the IdP's (self-signed) certificate.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%