Relying Party

[Cantor, Scott]

On 4/3/13 4:16 PM, "Stein, Eric" <steine at locustec.com> wrote:
>
>I think that using https is the right way to go. Where do I set that,
>though? Is that in the metadata, or shibboleth2.xml, or ?

In your web server. You're exposing it to http access. Don't do that.

If you're at a place that's stubborn about leaving secure servers
accessible to http because users refuse to stop using it, you should
configure the web server to force redirects on that vhost.

If you're using a web server that's more obnoxious than Apache
(cough...IIS), you can force the redierct in the SP itself, see the
redirectToSSL option.

And if you have to expose resources over http, you can limit SAML
endpoints to https with the handlerSSL option.

-- Scott