When DO you need IIS (or Apache)?

[Peter Schober]

* Craig Caughlin <craigcaughlin at gmail.com> [2014-01-31 14:15]:
> Which kind of begs the question...under what circumstances WOULD you
> want or NEED to have a web server application in use on your idP
> server?

Basically, if you have to ask you don't need it ;)
The most common reasons in the past I think were:

* To be able to continue use of an existing campus Web SSO system
  which had a module for httpd, in order to rely on httpd's
  REMOTE_USER as pre-authenticated principal instead of handling
  authentication in the IDP itself.
  This seems much less common today with Shibboleth itself being
  used for both federated and internal/campus SSO (as the policy
  engine and rich features are just as handy in campus use; also what
  was initially an "internal" service can now easily be exposed to
  others via federation; running one SSO system requires less effort
  than running two, etc.)

* To be able to support SOAP queries to the IDP, which are special in
  that they don't involve the subject's user agent and commonly require
  authentication with client certificates (by the SP), which need to
  be evaluated via SAML metadata, not some PKIX trust store.
  Traditionally this was best handled by running httpd on a seperate
  TCP port with special mod_ssl configuration.
  Today this is possible with Tomcat alone (currently only Tomcat6;
  though Tomcat7 might be added, cf. another thread this week) using
  an extension written by the Shibboleth project (I think).

* [On Unix(-like) systems]: to prevent running the JVM with root
  privileges (necessary to bind to ports 80 and 443); there are now
  several alternatives to that documented in the Shib wiki (and
  elsewhere), such as authbind or netfilter (iptables).

There are other things you can do once you have httpd in front (like
easily disabling requests to the IDP without stopping the Java process
and losing sessions, e.g. during upgrades or switchovers) but those do
not justify adding (and monitoring etc.) another deamon on the IDP
when one would suffice.
-peter