Advice on controlling IDP 3 administrative functions

[Koch, Ken]

Hoping someone on here has some ideas.. We use BIGIP F5's for load balancing and they have health monitors on them that decide when to offline a pool member. Every

One of the monitors on the IDP is /idp/profile/status and I've whitelisted the internal IP addresses of the F5's in the IDP Access Control. The downside is that any request flowing through the load balancers takes on that internal IP and such can access my administrative function pages.

My options as I see them:

-          Rename administrative flows in IDP to obfuscate them

-          Redirect rules on the F5 to dead-end the administrative urls

-          Implement basic auth on admin urls somehow at the machine level

Option 1 sounds the easiest, although least secure. Problem is, I don't know how to do this. Is there a way to modify the admin functions that won't get overwritten with an IDP upgrade?

Option 2 is doable, but the EAS group never likes custom F5 work. Grumpy folks.

Option 3 would require Apache I believe.

Other options?

____________________________________________________________
Ken Koch | Sr. Engineer
Information Services and Technology | Washington University in St. Louis
7425 Forsyth Blvd., Campus Box 1110 | St. Louis, MO 63105
w 314-935-8315 | c 314-223-7256 | ken at wustl.edu<mailto:ken at wustl.edu>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150417/43c0226d/attachment.html