SP with multiple Tomcat instances

[Peter Schober]

* jp <james.pittard at dsainc.com> [2018-01-15 16:36]:
> I have a Shibboleth 3.3.1 IDP running, and a Shibboleth 2.6.1 SP. The SP is
> running with Apache connected to Tomcat with a ProxyPass setting to Tomcat
> on AJP. It works great when connected to a single Tomcat instance.
> 
> I am now trying to get the SP set up to function for multiple Tomcat
> instances on the same server, each running on a different port. I found this
> that may be relevant, but I may not be understanding it correctly:
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride#NativeSPApplicationOverride-Hostvs.Path.
> 
> For one of the Tomcat installations running AJP on port 8011, I have added a
> VirtualHost in Apache httpd listening on port 7445. I set ServerName to
> hostname:7445 in the VirtualHost. Now when I go to
> https://hostname:7445/context, I get the following on the IDP:

Why would you want to expose the different TCP ports Tomcat listens to
via the TCP ports Apache httpd listens to? I.e., why not just map
different Tomcat ports to different REQUEST_URIs (on a single httpd
vhost) or to different name-based httpd vhosts? I.e.,
* tomcat 8011 becomes /app1 in httpd
* tomcat 8012 becomes /app2 in httpd
* etc.
or
* tomcat 8011 becomes https://one.example.org/ in httpd
* tomcat 8012 becomes https://another.example.org/ in httpd
etc.

You shouldn't need to expose any TCP ports other than the default
HTTPS one (443) on Apache httpd, no matter what happens with Tomcat.

That also has the side-effect of consistently only having endpoints on
https and hence no need to add ports to the SP's SAML Metadata, anywhere.

-peter