Shibboleth IdP (Tomcat6/OpenJDK1.6) Fresh Install Issues

[Joaquin Menchaca]

On 10/1/13 11:55 AM, Caskey, Paul wrote:
>
> Not sure why the wiki omits that, but here's what you need in tomcat's
> server.xml for port 443 (you can substitute your own commercial cert
> for idp.jks):
>
>  
>
> <Connector
>
> port="443"
>
> protocol="HTTP/1.1"
>
> SSLEnabled="true"
>
> maxThreads="150"
>
> scheme="https"
>
> secure="true"
>
> clientAuth="false"
>
> sslProtocol="TLS"
>
> keystoreFile="/opt/shibboleth-idp/credentials/idp.jks"   
>
> keystorePass="YourSecretPassword"/>
>
>  
>
>  
>
>  
>
>  
>
> *From:*users-bounces at shibboleth.net
> [mailto:users-bounces at shibboleth.net] *On Behalf Of *Joaquin Menchaca
> *Sent:* Tuesday, October 01, 2013 12:51 PM
> *To:* users at shibboleth.net
> *Subject:* Re: Shibboleth IdP (Tomcat6/OpenJDK1.6) Fresh Install Issues
>
>  
>
> On 10/1/13 10:33 AM, Kevin P. Foote wrote:
>
>     You will not see the endpoints or locations you see on the frontside communication
>
>     port generally (443) or if your offloading via apache or balancer 
>
>     your normal www port..
>
> I was following the process in in the wiki (1), that says to test if
> the IdP is properly installed by using the URL:
>
> |https://HOSTNAME/idp/profile/Status|
>
> |I followed the instructions using the Tomcat Container (2).  The
> instructions doesn't mention configured the connectors others than
> port 8443 for Supporting SOAP Endpoints.  Is there a connector I
> should add for 443?  Do I need to install a certificate in the
> keystore?  |
>
> |I am relatively new to Tomcat configurations. |
>
>
> 1 - https://wiki.shibboleth.net/confluence/display/SHIB2/IdPInstall
> 2 -
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
Hello.

Thank you.  I think I found a solution path: have load balancer take
incoming 443 and send it to 9443, which I have a connector configured
for that (from the snippet you sent me).

To have a local server listen on 443 gets complicated as I have just
learned, as you have to either have a service run as root to initially
listen on 443, or configure SELinux to permit a particular process to
listen on 443. 

As I installed tomcat from RPMs, I would either have change its config
(re-chown dirs, etc.) or uninstall and re-install from source, or I
would have to put an Apache httpd front end server, which opens a whole
can of worms to configure this, e.g. reconfiguring 8009 connector in tomcat.

- Joaquin Menchaca
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131001/cfbfbe02/attachment.html