remote access to aacli?

[Cantor, Scott]

On 6/17/15, 4:43 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 6/17/15, 4:17 PM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:
>
>>Short of tunneling, is there a means to make aacli accessible from a trusted remote host?
>
>I'm not sure if this qualifies as tunneling, but the IP ACLs are entirely up to you. Of course, I'm not advocating or non-advocating IP access control, but that's currently what it supports. The idea is to extend that over time to other security mechanisms, including actual user authentication via the IdP itself, but that's not in place yet.

I may have elided the basic fact that the command line tool itself is only talking localhost as a convenience, and all it's really doing is accessing the web service at /idp/profile/admin/resolvertest. If you want that to be accessible remotely, then my previous answer applies.

When you said tunnelling I started thinking you meant in the sense of being able to actually physically run the shell script, but that's certainly no requirement, nor is the script incapable of being run remotely from the IdP with the appropriate command line options.

-- Scott