Port 8443 and ProxyPass?

[Terry Smith]

Hi Tim,

     The AttributeQuery end point is there to allow service providers query
IdPs for users attributes. The port is protected so only SPs can access.
The SP holds the PKI key which is verified by the IdP before any access is
allowed using the SP certificate that is published in the metadata. On the
IdP side the SSL is done by a certificate that is also published in the
metadata. So if you attempt to do a wget on the URL below you will most
likely get refused access because you don't have the right keys or
certificates.

Thanks,
Terry.

On Mon, Oct 22, 2012 at 11:30 AM, Tim O'Connor <tim.oconnor at rmit.edu.au>wrote:

> I have a question about the use of port 8443.  What SHOULD happen when
> going to the url:
>
>
> https://sso-shibboleth-test.its.rmit.edu.au:8443/idp/profile/SAML2/SOAP/AttributeQuery
>
> I am getting a 'connection refused' message.
>
> We sit behind an f5 which does SSL off loading.  We did get port 8443
> excluded from the F5 config, so it is meant to go straight through
> unaltered.  In my apache config I have an entry for 8443:
>
> <VirtualHost _default_:8443>
>
> ServerName sso-shibboleth-test.its.rmit.edu.au:8443
> SSLEngine on
> SSLProtocol all -SSLv2
> SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
>
> SSLCertificateFile /software/shibboleth/cert/shibboleth-test.crt
> SSLCertificateKeyFile /software/shibboleth/cert/shibboleth-test.key
>
> SSLVerifyClient optional_no_ca
> SSLVerifyDepth  10
>
> SSLOptions -StdEnvVars +ExportCertData
>
> SetEnvIf User-Agent ".*MSIE.*" \
> nokeepalive ssl-unclean-shutdown \
> downgrade-1.0 force-response-1.0
>
> <IfModule mod_proxy_ajp.c>
>         ProxyRequests Off
>
>         <Proxy ajp://localhost:8009>
>                 Allow from all
>         </Proxy>
>
>         ProxyPass /idp ajp://localhost:8009/idp retry=5
> </IfModule>
>
> </VirtualHost>
>
> What I am not sure about is the proxypass settings above, and how that
> interacts with tomcat exactly...
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
*Terry Smith* | Technical Manager | Australian Access Federation Inc
*Tel:*  +61 7 3138 2424 | *Mob:*  0414 692 424
*Email* t.smith at aaf.edu.au <http://twitter.com/ausaccessfed> | *Web:*
http://www.aaf.edu.au <http://twitter.com/ausaccessfed> *| Support: *
http://supprt.aaf.edu.au <http://twitter.com/ausaccessfed>
*Twitter:* http://twitter.com/ausaccessfed *Facebook: *
http://facebook.com/ausaccessfed
*Mail: PO Box 9432 | Deakin  ACT  2600 | Australia*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121022/d3879c0e/attachment.html