Shibboleth client certificate

[Adam Jones]

That did it- a clientAuth setting in server.xml.  Do we require this setting for routine IdP/SP interaction?

I don't want to be disabling something that is required accidentally.

From: Nate Klingenstein <ndk at internet2.edu<mailto:ndk at internet2.edu>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Wed, 9 May 2012 19:07:07 +0000
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Shibboleth client certificate

Adam,

You're likely to have configured your web server -- Tomcat, if listening directly on the port where your login page is hosted, or Apache, if it's fronting that Tomcat -- to request client SSL certificates on that port.  Shibboleth itself wouldn't be making that request.

Check server.xml or httpd.conf for erroneous directives first.  I would guess you accidentally used configuration intended for port 8443(for back-channel calls between SP's and your IdP) for port 443.

Take care,
Nate.

On May 9, 2012, at 18:55 , Adam Jones wrote:

When my SP sends my browser over to our local IdP to the login page, it requests from me a client SSL certificate and fails when I do not allow it.   Is it normal to require the client browser's SSL certificate or is there a setting I missed?

-- To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120509/445e376a/attachment-0001.html