Protecting the tomcat default page on IdP

[Prashant Bapat]

Thanks Peter. May be I hit the send button too soon!

I will give httpd tunneling to tomcat a try.

On 24 March 2016 at 23:52, Peter Schober <peter.schober at univie.ac.at> wrote:

> * Prashant Bapat <prashant at apigee.com> [2016-03-24 17:22]:
> > - Each server with 2 NICs and separate IPs for each.
> > - IdP will be bound to 1 NIC and Apache httpd to another NIC.
> > - Shibbolet SP for Apache httpd configured to authenticate against IdP.
>
> It's not a question of interface cards (a single NIC can certainly
> severl IP addresses) or even IP addresses (you can do name-based
> vhosting just the same):
>
> If you want both the IDP and the SP to be reachable on the IDP's
> existing hostname (and I don't see why you wouldn't), and reachable on
> HTTPS (which is a given), then you can't have two web servers, one
> handling the SP and the other the IDP -- DNS doesn't know whether to
> give you the IP address of the IDP or SP if they share the same name
> in DNS.
>
> What works is what I previously explained, having Apache httpd handle
> all HTTPS (and maybe HTTP for the SP only, and only for the initial
> redirect to HTTPS) and tunneling requests to /idp to Tomcat.
> Tomcat is not reachable from the outside world in this case.
> Many people run their IDP that way anyway, for other reasons.
> (E.g. SWITCHaai fully documents such a setup for their members.)
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160325/1de17ba9/attachment.html>