SP and http(s)

[Peter Schober]

* Imbemba, Pasqualino <Pasqualino.Imbemba at provincia.bz.it> [2013-11-06 07:04]:
> The webapplication has static URL references to itself (we presume it 
> calls servlets) - but these are coded as http URLs. Is it advisable to 
> open SP to http, or to intervene on these references and set them to 
> https? Or does the SP take the http requests and 'renders' them to https?

Short answer: The Shibboleth SP will not interfere with for ordinary
requests to yourr application. No magic in involved here.

If the application generates URLs to itself which are plain http
either accessing them will fail (e.g. if there is no process listening
at tcp port 80) or you'd have to accept them insecurely (meaning all
HTTP sessio cookies cannot be limited to TLS/SSL protected reqeusts)
unless you manage to rewrite all those URLs to https /before/ they get
sent to the HTTP User Agent (e.g. via internal proxying).

Sending out plain http URLs and rewriting incoming requests to HTTPS
URLs (via redirects) for each new access request will not give you any
real security, cf. Moxie's sslstrip
http://www.thoughtcrime.org/software/sslstrip/
-peter