Hostnames fake & EntitiesID

[Kohler, Bernd]

Hi Peter,

why not adding 2 more loopback addresses - to "separate" IdP and SP - it
doesn't hurt, but maybe makes log files etc. better readable :)
And of course you can faked FQDN

grep 127.0 /etc/hosts
127.0.0.1       localhost
127.0.0.2       hosta.shibboleth.net
127.0.0.3       hostb.heise.de

ping -c3 hosta.shibboleth.net
PING hosta.shibboleth.net (127.0.0.2) 56(84) bytes of data.
64 bytes from hosta.shibboleth.net (127.0.0.2): icmp_req=1 ttl=64 time=0.021
ms
64 bytes from hosta.shibboleth.net (127.0.0.2): icmp_req=2 ttl=64 time=0.026
ms
64 bytes from hosta.shibboleth.net (127.0.0.2): icmp_req=3 ttl=64 time=0.028
ms

--- hosta.shibboleth.net ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1998ms
rtt min/avg/max/mdev = 0.021/0.025/0.028/0.003 ms


ping -c3 hostb.heise.de
PING hostb.heise.de (127.0.0.3) 56(84) bytes of data.
64 bytes from hostb.heise.de (127.0.0.3): icmp_req=1 ttl=64 time=0.019 ms
64 bytes from hostb.heise.de (127.0.0.3): icmp_req=2 ttl=64 time=0.025 ms
64 bytes from hostb.heise.de (127.0.0.3): icmp_req=3 ttl=64 time=0.039 ms

--- hostb.heise.de ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1998ms
rtt min/avg/max/mdev = 0.019/0.027/0.039/0.010 ms


Of course SSL on 127.0.0.0/8 is not really needed , but in case you want a
real Test-Installation certificates are part of this. If you want to get rid
of warnings, why not temporary import certificates into your browser
cert-store - run your own CA for testing?

Best

Bernd


---
RWTH Aachen University, Center for Computing and Communication
Rechen- und Kommunikationszentrum
Abteilung PIT / IT-Prozessunterstützung
Dienstgebäude ComNets 
Kopernikusstr. 5, 52074 Aachen (Germany)
Tel.: + 49(0)241/80-29793 - Fax: +49(0)241/80-22134


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Peter Schober
Sent: Thursday, May 23, 2013 3:55 PM
To: users at shibboleth.net
Subject: Re: Hostnames fake & EntitiesID

* Kohler, Bernd <Kohler at rz.rwth-aachen.de> [2013-05-23 15:18]:
> Of course you have to adjust IdP configuration to fit
> 127.0.0.2/127.0.0.3 and /etc/hosts entries.

If you're going to modify your local DNS resolver via /etc/hosts you'll gain
nothing by adding more loopback addresses into the mix.
The IdP doesn't care about IP addresses at all.
And why bother setting up IP-based SSL vhosting (or name-based, for that
matter) when all you're using are bogus certificates anyway (i.e., you'll be
prompted with security warnings either way)?

To the OP: Does the existing documentation help?
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSPLocalTestInstall
-peter
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5557 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130523/4bcbbb62/attachment.bin