When DO you need IIS (or Apache)?

[Peter Schober]

* Paolo Smiraglia <paolo.smiraglia at polito.it> [2014-01-31 14:38]:
> I use Apache for implementing a reverse proxy toward my Tomcat which
> is listening only on localhost for security reasons. Moreover,
> thanks to Apache, the IdP is accessible only on HTTPS and the users
> could be authenticated through X509 certificates.

1. How does one process handling TLS/SSL (httpd) instead of another
one (tomcat) in itself improve security -- unless you're implying that
Tomcat's HTTPS implementation is inscecure/broken?

2. What stops you from having Tomcat only listen on TCP/443? You don't
need another server process to only be accessible via HTTPS

3. That's a valid historic reason: More choice of authentication
modules that are available for httpd than for Tomcat. Of course today
you can just use the X.509 login handler for Shibboleth.
-peter