Automating the generation of IdP metadata

[Franck Mangin]

Hi Peter, thanks for your answer.

I currently have everything behind Apache httpd, and everything HTTPS. Browsers get redirected to the IdP at  https://.../idp/... on port 443.

In other terms SingleSignOnService is at https://apache.acme.com/idp/...

So if I understand you correctly I need to open an additional https port on Apache for the ArtifactResolutionService and AttributeService.

Is there any way to modify the 8443 default without editing the auto-generated idp-metadata.xml? 
Also I assume that the SP (or anyone who needs those services) will take the port number from the IDP metadata, so that it's the only place where that port number need to be configure?

Thanks!
Franck

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Friday, February 12, 2016 2:07 PM
To: users at shibboleth.net
Subject: Re: Automating the generation of IdP metadata

* Franck Mangin <FranckMangin at fico.com> [2016-02-12 11:52]:
> However the auto-generated file also contains incorrect Locations for 
> the ArtifactResolutionService and AttributeService elements, because 
> my https port is not 8443.

You're mistaken. That is not for browser-facing access and special properties (and different keys) apply to that port.

You might decide to not use the features offered on that port (Artifact resolution and Attribute Queries), but then you'd remove those wholesale.
You might also decide to move those to different ports (for whatever reason), but either way, it should not be the IANA-registered port 443 for https.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This email and any files transmitted with it are confidential, proprietary and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please delete it immediately.