Further IDP and Firefox Security Warning Message Questions

[Peterson, Tommy]

OK. I understand what you and Paul and Scott are saying.

But, if I do all of this, and I have to recreate the 8443 connector just like the docs say, why am I getting a blank white page when I try to even access even the tomcat manager page, when with my current set up? I just point the browser to https://(myidpsdomain):8443 and the Tomcat manager page shows up. When I change the settings in the 8443 connector to match what the Shibboleth docs have that URL shows a blank, white page with no errors printed to the the IDP or Tomcat logs.

Will reconfiguring this and adding the following three to the 8443 connector will eliminate this issue? These issues are related then?
*       SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
*       protocol="org.apache.coyote.http11.Http11Protocol"
*       clientAuth="true"

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Wednesday, August 03, 2011 2:18 PM
To: Shib Users
Subject: Re: Further IDP and Firefox Security Warning Message Questions

Paul Hethmon wrote:
> Tommy,
>
> How you expose your IdP or SP is totally up to you. What is being said
> here is that the well known port for HTTPS (HTTP over SSL) is port 443.
> That's not required, but is the IANA registered port assignment. Tomcat,
> as a standalone web server, sets its default port for HTTPS to 8443. If
> you wanted to run Tomcat as a web server using HTTPS, then you would
> typically change that connector to port 443.

And in the case where you (Tommy, not Paul) are doing SSL termination at
a loadbalancer, you could change the port to 80 (to reduce confusion),
or whatever port your loadbalancer ends up sending the traffic to.  In
that case, you don't configure SSL there at all.

> For Shibboleth back channel, meaning attribute query from an SP to your
> IdP, then you would use 8443. The reason for the difference is that
> Shibboleth owns the TLS/SSL trust in that connection. So it's not just SSL
> there, it's using SSL to negotiate mutual trust between the SP and the IdP.

This also means that your load balancer MUST NOT do SSL offloading for
the backchannel port (8443).  It should just pass the traffic through
as-is and let Tomcat handle the SSL negotiation (with the extra
connector configuration to use the IDP's keystore instead of the
publicly-facing cert's keystore for port 443, and the special
delegate-to-app SSL handler class).

So, summary for your situation (loadbalancer in front of IdP), the load
balancer is listening on two ports, 443 and 8443.

On port 443, the LB does SSL offloading and routes requests to the real
server's port 80.  It uses the publicly facing certificate (signed by a
"real" CA).

On port 8443, the LB does NOT do SSL offloading, and routes requests to
the real server's port 8443.

Tomcat is configured to listen on two ports, 80 and 8443.  On port 80
there is no SSL.  On port 8443 Tomcat is set up with the special
backchannel SSL configuration, with the IdP's (self-signed) certificate.

--
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This message contains Devin Group confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.
 Please notify the sender immediately by e-mail if you have received this e-mail in error and delete this e-mail from your system. E-mail transmissions cannot be guaranteed secure, error-free and information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or contain viruses. The sender therefore does not accept liability for errors or omissions in the contents of this message which may arise as result of transmission. If verification is required please request hard-copy version.