Shibboleth SAML in non Standard Ports (https)

[Peter Schober]

* Andrés Yacopino <ayacopino at gmail.com> [2015-04-25 16:59]:
> Hi, I am new with Shibboleth and SAML, trying to deploy a Shibboleth SAML
> IDP internally to be integrated with and external Service Provider (SP).
> We have a firewall to internet and we are already using port 443 (https) in
> the firewall redirecting to also port 443 to an internal server.
> 
> So only having 1 external Static IP to Internet so I can't use port 443 for
> Shibboleth.
> 
> I am seeing that in metadata.xml port 8443 and 443 exists.
> I have imported SP metadata and send our metadata to SP, but it seems in
> testing (one url that SP has sent), it is trying to connect to port 443.

(Note it's not the SAML SP connecting to port 443, but the subject's
web browser.)

You can have your web server listening on whatever port you want!
Shibboleth is not the webserver, so there's nothing in Shibboleth to
configure here. You can also use whatever method you want to offload
TLS or mess with ports and redirections, though what you describe
above sounds like less than ideal (forwarding requests to internal
services based on the externally used port).

The only requirement for the SAML metadata describing your IDP is that
it matches your setup. I.e., when the browser-facing part of your web
server is accessible at port <n>, then use <n> instead of 443 (or
instead of no port, as 443 is the default for https) in SAML
metadata. Same for port <m> instead of 8443, if you need to support
the back channel requests: it needs to match the port (and hostname)
that has to be used when trying to connect. Anything else is up to
you.
-peter