Successful IDPv2 to v3 Migration

[Cantor, Scott]

On 7/20/15, 9:04 AM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:
>
>In this case it was the original jetty process using 8443 for the main https page. I had 443 redirected to 8443.
>
>Thus to work around that I had Jetty also use 8009 for the SOAP endpoint, then redirected 8443 to that. Routing wise it is a bit confusing I confess.

That seems a little odd. I guess it avoids the setuid issue, but I can't think of any other reason to do that, and setuid really isn't that hard to use.

My experience with firewall redirects are that somebody inevitably ends up dropping the firewall to do something and takes down the redirects.

>Not entirely, the idp.crt and idp.key I had before from the v2 installation. By that I meant I just had to make them into a pkcs12 keystore so that Jetty could be configured properly, specifically for these lines:

We don't repackage the old credentials on an update into a PKCS file but we probably could do that with some work. It's something we didn't automate because we really didn't want to even touch credentials on an upgrade, we wanted it to be entirely the same so no surprises lurking.

-- Scott