Further IDP and Firefox Security Warning Message Questions

[Peterson, Tommy]

OK.
I asked the IT Support folks to close 8443 (it was externally open) and to open 443 to the outside.
I changed the 8443 Tomcat Connector to what the Shibboleth docs said (SSLImplmentation, protocol, and clienthAuth) and Scott said yesterday was necessary.
I added the 443 Tomcat Connector.
I don't even need the 80/8080 directives in the Tomcat server.xml file as that port is not open on the LB for the IDP server and you can't even access anything on it. Right?
I created a new keystore with only the public godaddy certs and associated that with the 443 Tomcat connector.
I left the other keystore I already had and the self signed IDP stuff in it and left the 8443 Tomcat connector pointing to that.
I restarted Tomcat of course. Clear out the cache of course.

I am no longer getting the blank white page. So that part is fixed. I can still throw up the login page for protected service and I can successfully authenticate as I should be able to (or as the case may be not authenticate without an actual user ID and password). I get the OK on the status page. The weird (or good) thing is that the SSL indicator in the browser still shows up as the blue illuminated box but now I am getting a key icon as well.

However, I am still getting the Firefox pop up, which is what I need fixed and really started this chain.

So where does the backchannel 8443 stuff come in to play? Is this done automatically through the IDP code? Do I need to add 8443 back to the IDP's metadata? Will that make this Firefox pop up window go away with this new configuration? I left that like I changed it yesterday--I removed the ":8443" from all the URLs in the metadata? Scott said yesterday the Firefox pop up was because the SSL was being dropped. I am not intentionally dropping it. I understood yesterday's emails to say that I ideally needed 443 open on the LB so that the log in page could show up HTTPS using the public godaddy cert. But that once that took place the IDP communicated behind the scenes with 8443 which is why I needed that with only the self signed IDP cert and keystore. That has been changed.

Is the Firefox popup related to something else?

Also when you say "point your load balancer port 443 (offloading SSL) at tomcat's port 8080, and LB port 8443 (no SSL offload) to tomcat 8443." What exactly am I supposed to be doing to "point" the ports this way? Virtual hosting on Tomcat? Or is this done with just the connectors?

Obviously I missing a fine point here.




-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Thursday, August 04, 2011 10:39 AM
To: Shib Users
Subject: Re: Further IDP and Firefox Security Warning Message Questions

Peterson, Tommy wrote:
> OK. I understand what you and Paul and Scott are saying.
>
> But, if I do all of this, and I have to recreate the 8443 connector just like the docs say, why am I getting a blank white page when I try to even access even the tomcat manager page, when with my current set up? I just point the browser to https://(myidpsdomain):8443 and the Tomcat manager page shows up. When I change the settings in the 8443 connector to match what the Shibboleth docs have that URL shows a blank, white page with no errors printed to the the IDP or Tomcat logs.

I would expect you to get whatever the "root" tomcat page is (e.g. the
"Congratulations on untarring Tomcat" page)...

> Will reconfiguring this and adding the following three to the 8443 connector will eliminate this issue? These issues are related then?
> *       SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
> *       protocol="org.apache.coyote.http11.Http11Protocol"
> *       clientAuth="true"

So, a version 6 Tomcat default configuration has an HTTP listening on
8080, a commented-out HTTPS listener on 8443, and an AJP listener on
8009.  For your situation, you could just comment out the AJP listener
(since you're not frontending with Apache), add the 8443 listener from
the IdP installation page under "supporting SOAP endpoints", and point
your load balancer port 443 (offloading SSL) at tomcat's port 8080, and
LB port 8443 (no SSL offload) to tomcat 8443.

For testing, don't hit the root URL, as it is irrelevant to the IdP's
operation.  Instead, try the status page at:

  https://youridploadbalanceraddress/idp/profile/Status

and see if you get the magical "OK".  Testing port 8443 is better left
to trying an actual SP with it.

--
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This message contains Devin Group confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.
 Please notify the sender immediately by e-mail if you have received this e-mail in error and delete this e-mail from your system. E-mail transmissions cannot be guaranteed secure, error-free and information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or contain viruses. The sender therefore does not accept liability for errors or omissions in the contents of this message which may arise as result of transmission. If verification is required please request hard-copy version.