SSL offloading breaks ECP

[Ryan Suarez]

On 13-01-25 3:07 PM, Cantor, Scott wrote:
> I can't think of anything it would affect, so without knowing what the
> error is, I can't really say. It shouldn't be debug logs at issue, the
> question is what the error is.
>
> Of course, ECP is (normally) basic auth, so if your offloading doesn't
> forward that information, clearly it isn't going to work, but that should
> be self-evident.

Ok, looks like a problem with basic auth.

My connector definition:
     <Connector port="8080" protocol="HTTP/1.1"
                connectionTimeout="20000"
                redirectPort="8443"
                 scheme = "https"
                 proxyPort = "443"/>

tcpdumps on the IdP shows it redirecting the SP to port 8443.  basic 
auth was configured with a transport-guarantee of 'CONFIDENTIAL' which 
was forcing this redirect.  If I set transport-guarantee to 'NONE' then 
ECP works.

Any concerns with leaving transport-guarantee as 'NONE'?