Has shibd to run on the same server

[Peter Schober]

* Marc Kalberer <info at programmers.ch> [2014-07-24 17:31]:
> The reason is because of the infrastructure of the hosting company
> Im working with.  They are pretty flexible but
> - they allow daemons to be run only as "non-root" user
> - they run apache on a dedicated server, different from the one
> accessed by ssh (on witch the daemon would be running)

IMHO they should just run the daemon on the machine also hosting the
webserver, i.e. offer it as part of the webserver package.

Like the documentation says, it's an implementation detail
for privilege and session separation from the webserver process.
Users don't do anything with that daemon directly, it's not useful to
have on the login machine.

So I don't think this will work the way they expect it to.
E.g. who will configure shibboleth2.xml? You can't have a seperate
configuration file for ever user, so that needs to be done by the
provider. And that only makes sense if they accept everything that
comes with offering a Shibboleth-enabled hosting environment.
That's more than just putting mod_shib on a system.
-peter