Protecting the tomcat default page on IdP

[Prashant Bapat]

Thanks Peter/Scott.

I will probably go with something like this.

- Each server with 2 NICs and separate IPs for each.
- IdP will be bound to 1 NIC and Apache httpd to another NIC.
- Shibbolet SP for Apache httpd configured to authenticate against IdP.

Guess this should work.

Thanks again for your help.


On 24 March 2016 at 19:59, Peter Schober <peter.schober at univie.ac.at> wrote:

> * Prashant Bapat <prashant at apigee.com> [2016-03-24 06:33]:
> > Essentially IdP and SP in same box.
>
> That is your answer. There's nothing special to it, other than the
> fact that there's no Shib SP for Java, so if Tomcat is your (only) web
> server you'd have to move that behind e.g. Apache httpd and tunnel
> everything through httpd via AJP.
>
> (Nothing stops you from using a different SAML SP implementation, of
> course, if you'd rather not change anything about your IDP.)
>
> I did this many years ago (with a trivial Perl CGI page protected by
> the Shib SP), mostly to allow us to promote people bookmarking "the
> IDP" (when it really is an SP), instead of telling them not to
> bookmark the IDP login page (which meanwhile was made much easier and
> the IDP now by default detects such requsts and can give appropriate
> comments).
> Starting SSO at a bookmarked location also seemed more secure than
> letting some website redirect you to (hopefully) the right login page.
>
> Initially that SP also had a list of available applications, but that
> soon grew unweildy, with the number of services growing.
>
> Different groups within the institution than had issues with that
> approach for different reasons, and while the SP at the IDP is still
> there, it doesn't do anything these days, other than presenting you a
> "login" link (before authn) or a mostly useless statement that you
> have now established an SSO session and can go off and access desired
> services directly, like you did before.
>
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160324/d78cef57/attachment-0001.html>