Relying Party

[Stein, Eric]

Thanks, Scott. I'm taking a look at my options. Is it adequate to have my firewall reject requests to port 80, or should I leave it open and have httpd force redirects on 80 to 443?

Eric


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, April 03, 2013 4:23 PM
To: Shib Users
Subject: Re: Relying Party

On 4/3/13 4:16 PM, "Stein, Eric" <steine at locustec.com> wrote:
>
>I think that using https is the right way to go. Where do I set that, 
>though? Is that in the metadata, or shibboleth2.xml, or ?

In your web server. You're exposing it to http access. Don't do that.

If you're at a place that's stubborn about leaving secure servers accessible to http because users refuse to stop using it, you should configure the web server to force redirects on that vhost.

If you're using a web server that's more obnoxious than Apache (cough...IIS), you can force the redierct in the SP itself, see the redirectToSSL option.

And if you have to expose resources over http, you can limit SAML endpoints to https with the handlerSSL option.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net