defending shib-idp after commercial cert installed for tomcat6

[Cantor, Scott]

On 1/9/14, 10:53 AM, "Gene Matthews" <gmatthew at hitachi-cta.com> wrote:
>
>End users go to the SP's site (port 443) which redirects back to our Idp
>(user sees https://<idp>:8443/idp/....  as the url in their browser) and
>there they see the idp login page.  Once they authenticate, Idp sends
>them back to SP (https/443).  That has been working for some time now
>with the self-signed cert referenced in tomcat's server.xml file.

Users should never access non-standard ports. You can't generally support
backchannel traffic for SOAP on the same port as user access and make this
work, so that means you aren't using the back channel at all, and your use
of TLS certificates should have nothing to do with Shibboleth whatsoever.

>The only thing being changed is the self-signed cert referenced in
>tomcat's server.xml file.  When we put that in place, we see the browser
>fails to load the idp login page when the SP redirects to the Idp.  When
>this happens, I'm thinking it isn't making it past the tomcat connector
>as I don't see anything traffic in the idp-process.log.

We know it isn't.

-- Scott