SHibboleth question

[Juan Quintanilla]

Hi,



I have setup Cas and SHibboleth and I'm using apache on the front end and tomcat for the backend.  Apache is listening on port 443 with an ssl cert sending the traffic to the ajp connector port 8009.

<Connector port="8009" address="127.0.0.1"
              enableLookups="false" redirectPort="8443" protocol="AJP/1.3"
              tomcatAuthentication="false" />

 I also have the connection for port 8443 setup in tomcat instead of apache for Supporting SOAP Endpoints similar to what is found in https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare

<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11Protocol"
           SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation"
           scheme="https"
           SSLEnabled="true"
           clientAuth="true"
           keystoreFile="IDP_HOME/credentials/idp.jks"
           keystorePass="PASSWORD" />

Do you know if there are any benefits for setting up the 8443 connection on tomcat rather than just using apache and commenting out the connector for port 8443?  Also since port 8443 is using self signed certificates that are generated during the shibboleth install is it normal that in IE a windows security popup box appears asking you choose a certificate to authenticate when hitting https://idp.localhost:8443 then after choosing a cert you are then shown the page website's security certificate page and asked if you wish to continue to the site.

Is anybody redirecting users to a different page if the hit https://localhost or https://localhost:8443 or are you just blocking access?

___________________
Juan Quintanilla
UTS - Enterprise Group
305-348-6573
jquin014 at fiu.edu
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Terry Soucy [terry.soucy at unb.ca]
Sent: Friday, September 23, 2011 1:01 PM
To: Shib Users
Subject: Re: Shibboleth setup.. So close but can use some help..

Hi Juan,

We just completed our IdP setup to auth against our CAS server (instead
of ldap).  All information was grabbed from the following URL ..

https://wiki.jasig.org/display/CASUM/Shibboleth-CAS+Integration

The only thing they left out (I thought it was obvious, but you never
know) was that you have to comment out the standard UsernamePassword
login handler, since you'll be using the RemoteUser handler supplied in
the documentation.

Terry

On 09/23/2011 01:28 PM, Juan Quintanilla wrote:
> Hi,
>
> Has anyone setup Shibboleth to work with CAS? If so can anyone provide some information regarding that initial setup.

--
Terry Soucy, Systems Analyst             Integrated Technology Services
University of New Brunswick, Fredericton Campus  http://www.unbf.ca/its
Voice: 506.447.3018     Fax: 506.453.3590    E-mail: terry.soucy at unb.ca
**    ITS is a scent-reduced workplace - www.unbf.ca/its/policies    **
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net