Turning off attribute query and artifact resolution endpoints

[Peter Schober]

* Andrew Morgan <morgan at orst.edu> [2014-07-16 21:42]:
> I asked a similar question here a while back.  Scott Cantor told me to 
> leave things alone in handler.xml.  He recommended I just remove the 
> endpoints from my metadata.  I don't remember the particular justification 
> for leaving handler.xml as-is, but I followed his advice.  :)

If you don't announce support for those bindings in SAML metadata and
don't publish Locations for those endpoints, it's highly unlikely
someone would send actual SOAP/Atficat requests to those endpoints.
(They would have to guess the endpoints based on the software used or
based on cached, by then expired SAML metadata. But this is not
preventing a security while, this is not offering securely implemented
additional functionality.)

The other obvious thing to do (after you removed the support from
metadata and waited for propagation) is to just shut off port 8443 via
your packet filter and/or firewall. That makes sure even those
hypothetical agents guessing at the unpublished location and still
sending you attribute queries won't get their requests serviced.
-peter