https://wiki.shibboleth.net/confluence/display/IDP30/SecurityAndNetworking just ports 443 (and 8443 for backchannel - you may want port 80 with a redirect to the secure port) alan