Further IDP and Firefox Security Warning Message Questions

[Christopher Bongaarts]

Peterson, Tommy wrote:

> So where does the backchannel 8443 stuff come in to play? Is this
> done automatically through the IDP code? Do I need to add 8443 back
> to the IDP's metadata? Will that make this Firefox pop up window go
> away with this new configuration? I left that like I changed it
> yesterday--I removed the ":8443" from all the URLs in the metadata?

In your metadata, the :8443 would be on the back channel services 
(AttributeAuthority, ArtifactResolutionService).  It would *not* be on 
the front-channel services (like SingleSignOnService).  I believe the 
IdP installer generates this correctly for you during install.

> Also when you say "point your load balancer port 443 (offloading SSL)
> at tomcat's port 8080, and LB port 8443 (no SSL offload) to tomcat
> 8443." What exactly am I supposed to be doing to "point" the ports
> this way? Virtual hosting on Tomcat? Or is this done with just the
> connectors?

This is getting off-topic, but this is referring to the port abstraction 
you typically get with a load balancer.  The load balancer is configured 
to listen on a set of addresses and ports, and forward connections to a 
set of backend servers on a different address and port.  So if I had a 
load balancer servicing requests to example.com port 443, it might be 
configured to farm the requests out to server1.example.com port 443, 
server2.example.com port 10443, server3.example.com port 20443 and 
server3.example.com port 30443.  The client never sees the backend 
server names or ports - just the load balancer, which handles the 
translation and monitors the servers.

In a situation with SSL offloading, a typical setup will have the load 
balancer listen on port 443, and forward traffic to the backend servers 
on port 80.  This gives a visual cue to the system administrator that, 
at that point, the connection is no longer SSL (because the load 
balancer already handled it).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%