Protecting the tomcat default page on IdP

[Peter Schober]

* Prashant Bapat <prashant at apigee.com> [2016-03-24 06:33]:
> Essentially IdP and SP in same box.

That is your answer. There's nothing special to it, other than the
fact that there's no Shib SP for Java, so if Tomcat is your (only) web
server you'd have to move that behind e.g. Apache httpd and tunnel
everything through httpd via AJP.

(Nothing stops you from using a different SAML SP implementation, of
course, if you'd rather not change anything about your IDP.)

I did this many years ago (with a trivial Perl CGI page protected by
the Shib SP), mostly to allow us to promote people bookmarking "the
IDP" (when it really is an SP), instead of telling them not to
bookmark the IDP login page (which meanwhile was made much easier and
the IDP now by default detects such requsts and can give appropriate
comments).
Starting SSO at a bookmarked location also seemed more secure than
letting some website redirect you to (hopefully) the right login page.

Initially that SP also had a list of available applications, but that
soon grew unweildy, with the number of services growing.

Different groups within the institution than had issues with that
approach for different reasons, and while the SP at the IDP is still
there, it doesn't do anything these days, other than presenting you a
"login" link (before authn) or a mostly useless statement that you
have now established an SSO session and can go off and access desired
services directly, like you did before.

-peter