How to completely shut Shib off without uninstalling

[Meiselman, Ellen]

Hi all, 

Shib is up and running fine in our reverse proxied setup, thanks to your help. 

I need to test something without Shibboleth interfering in any way whatsoever, so i would like to shut it off completely without removing the handlers, module and such.  Is the best way to put "required: false" on the directory listing in shibboleth2.xml? That turns off the protection but I'm not sure completely removes all Shib processing from the situation.

If i just turn off the Shibd service that just creates 500 errors (windows server errors). 

I'm trying to run down a sneaky problem that is in PROD but not QA, and I want to be sure nothing I have added to the system is getting in the way.


Thank you, 

Ellen
______________________________
Ellen Meiselman
University of Michigan Health System
MLearning
NCRC
2800 Plymouth Rd. 
Building 200, Rm 207
Ann Arbor, MI 48109-2800
E-Mail:  emeiselm at umich.edu
Phone (734) 936-2334

On Jan 13, 2015, at 11:59 AM, Peter Schober wrote:

> * samir el otmani <elotmani.samir at gmail.com> [2015-01-13 16:14]:
>> if we can access the metadata by simple URL like this one :
>> https://federation.renater.fr/test/renater-test-metadata.xml
>> 
>> what is the utility to verify the signature on loaded metadata
> 
> See
> https://wiki.shibboleth.net/confluence/display/SHIB2/TrustManagement
> for one explanation.
> 
> If you're accessing a HTTPS resource with a webbrowser interactively
> you have some chance of dealing with failure modes.
> A repeated and fully automated HTTP GET from a HTTP client library for
> a plain text file (SAML metadata) on the other hand may not give you
> the security you think you have, esp if that plain text file is used
> to bootstrap trust into self-signed certificates and protocol
> endpoints of contained entities.
> I.e., /all/ of the trust comes from a signature on that metadata (in
> the "Sign and Expire" model, as per the article above).
> 
> That's why many trust framework providers ("federations") do not even
> publish their SAML metadata over https, as to not lead people into
> thinking that TLS is sufficient.
> -peter
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues