Protecting the tomcat default page on IdP

[Peter Schober]

* Prashant Bapat <prashant at apigee.com> [2016-03-24 17:22]:
> - Each server with 2 NICs and separate IPs for each.
> - IdP will be bound to 1 NIC and Apache httpd to another NIC.
> - Shibbolet SP for Apache httpd configured to authenticate against IdP.

It's not a question of interface cards (a single NIC can certainly
severl IP addresses) or even IP addresses (you can do name-based
vhosting just the same):

If you want both the IDP and the SP to be reachable on the IDP's
existing hostname (and I don't see why you wouldn't), and reachable on
HTTPS (which is a given), then you can't have two web servers, one
handling the SP and the other the IDP -- DNS doesn't know whether to
give you the IP address of the IDP or SP if they share the same name
in DNS.

What works is what I previously explained, having Apache httpd handle
all HTTPS (and maybe HTTP for the SP only, and only for the initial
redirect to HTTPS) and tunneling requests to /idp to Tomcat.
Tomcat is not reachable from the outside world in this case.
Many people run their IDP that way anyway, for other reasons.
(E.g. SWITCHaai fully documents such a setup for their members.)
-peter