SHibboleth question

[Cantor, Scott]

On 12/5/11 1:20 PM, "Juan Quintanilla" <jquin014 at fiu.edu> wrote:
>
>I have setup Cas and SHibboleth and I'm using apache on the front end and
>tomcat for the backend.  Apache is listening on port 443 with an ssl cert
>sending the traffic to the ajp connector port 8009.
>
><Connector port="8009" address="127.0.0.1"
>              enableLookups="false" redirectPort="8443" protocol="AJP/1.3"

Then this redirect port should be 443, not 8443.

>I also have the connection for port 8443 setup in tomcat instead of
>apache for Supporting SOAP Endpoints similar to what is found in
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepar
>e

That's fine.

>Do you know if there are any benefits for setting up the 8443 connection
>on tomcat rather than just using apache and commenting out the connector
>for port 8443?

One issue is that we no longer will be actively developing those trust
plugins for Tomcat connectors, and focusing on Jetty. In general using
Tomcat alone, or Jetty, gives the most control and avoids spurious cert
rejection that Apache will occasionally cause. In most cases, they both
work about the same. If you already have Apache, there's something to be
said for consistency.

>  Also since port 8443 is using self signed certificates that are
>generated during the shibboleth install is it normal that in IE a windows
>security popup box appears asking you choose a certificate to
>authenticate when hitting https://idp.localhost:8443 then after choosing
>a cert you are then shown the page website's security certificate page
>and asked if you wish to continue to the site.

You don't visit that port with a browser.

>Is anybody redirecting users to a different page if the hit
>https://localhost or https://localhost:8443 or are you just blocking
>access?

Users don't access the latter. Why would you redirect users from the
former?

-- Scott