Shibboleth SAML in non Standard Ports (https)

[Andrés Yacopino]

Hi again. I have put that I didn't work.
So I am trying to modify metadata.xml, do I need to change all urls to
have port 7443 (I want to use this instead of 443):

There are several entries to modify, some with 8443 and some with only
443, so what is needed to be modified to port 7443?

       <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="https://idptest.acasalud.com.ar:8443/idp/profile/SAML1/SOAP/ArtifactResolution"
index="1"/>

        <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://idptest.acasalud.com.ar:8443/idp/profile/SAML2/SOAP/ArtifactResolution"
index="2"/>

        <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://idptest.acasalud.com.ar/idp/profile/SAML2/Redirect/SLO"
/>

        <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://idptest.acasalud.com.ar/idp/profile/SAML2/POST/SLO"
/>

        <SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://idptest.acasalud.com.ar:8443/idp/profile/SAML2/SOAP/SLO"
/>

        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

        <SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="https://idptest.acasalud.com.ar/idp/profile/Shibboleth/SSO"/>

        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://idptest.acasalud.com.ar/idp/profile/SAML2/POST/SSO"/>

        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="https://idptest.acasalud.com.ar/idp/profile/SAML2/POST-SimpleSign/SSO"/>

        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="https://idptest.acasalud.com.ar/idp/profile/SAML2/Redirect/SSO"/>
    </IDPSSODescriptor>

Thanks,

Andres.

2015-04-25 16:45 GMT-03:00 Andrés Yacopino <ayacopino at gmail.com>:
> Thanks for the help Nate.
> Do you think I can install again Shibboleth using install.sh and
> putting in here:
>
> What is the fully qualified hostname of the Shibboleth Identity
> Provider server? [idptest.domain.com]
>
> idptest.domain.com:8443
>
> And that could work?
>
> Thanks
> Regards,
> Andres.
>
>
> 2015-04-25 12:25 GMT-03:00 Nate Klingenstein <ndk at internet2.edu>:
>> Andrés,
>>
>> You should only need to configure your servlet container to listen on the
>> non-standard port(e.g. an SSL connector listening on 9443) and your IdP
>> metadata(specifically, the SingleSignOnService endpoints) needs to match.
>> e.g.
>>
>> <EntityDescriptor entityID="https://ndk.shibathome.lalala/idp/shibboleth">
>>
>> …
>>
>> <SingleSignOnService
>> Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
>> Location="https://ndk.shibathome.lalala:9443/idp/profile/SAML2/Redirect/SSO"/>
>>
>> You’ll also have to watch out for firewalls in the intermediate networks, of
>> course.
>>
>> Hope this helps,
>> Nate.
>>
>> On Apr 25, 2015, at 8:58 AM, Andrés Yacopino <ayacopino at gmail.com> wrote:
>>
>> Hi, I am new with Shibboleth and SAML, trying to deploy a Shibboleth SAML
>> IDP internally to be integrated with and external Service Provider (SP).
>> We have a firewall to internet and we are already using port 443 (https) in
>> the firewall redirecting to also port 443 to an internal server.
>>
>> So only having 1 external Static IP to Internet so I can't use port 443 for
>> Shibboleth.
>>
>> I am seeing that in metadata.xml port 8443 and 443 exists.
>> I have imported SP metadata and send our metadata to SP, but it seems in
>> testing (one url that SP has sent), it is trying to connect to port 443.
>>
>>
>> The question is, what changes I need to do to make Shibboleth works in non
>> standard port 443?
>>
>> Thanks for the help.
>>
>> --
>> Andrés Yacopino
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
>
> --
> Andrés Yacopino



-- 
Andrés Yacopino