Handle HTTPS and HTTP to same IIS Web Site

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2018-01-31 12:32]:
> > With the semi-packaged application I primarily support and integrate
> > with, there have been an unfortunate number of times in the last few
> > years when thorny problems have involved needing to look in detail
> > at network traffic and Windows ProcMon activity to prove to vendors
> > that their logging is inadequate or just plain incorrect.
> 
> Since this is the Shibboleth mailing list the only thing of relevance
> here is Shibboleth behaviour and debugging of (mainly) SAML protocol
> messages. And all of the details you'd need to debug issues here can
> be logged by the Shibboleth software (and sometimes web server
> software).
> So claiming you need to break or avoid TLS to the server is silly, IMO.
> 
> If you're talking about other aspects of your application stack, well,
> then this has nothing to do with this list.

I'll have to take that back. I think I now understand that you're
routinely trying to replicate some application issues by avoiding TLS,
and that the issues you're trying to debug have nothing to do with
Shibboleth or SAML. But the fact that the server is protected by
Shibboleth/SAML makes your chosen approach difficult/impossible.

With Apache httpd there's no issue with protecting multiple vhosts on
multiple ports (80 vs 443) speaking multiple protocols (HTTP vs
HTTPS). Besides server configuration you'd have to amend the SAML
metadata to add plain HTTP protocol endpoints, of course.
I don't have anything to offer wrt MS-IIS, though.

So I still think that that's a needlessly complicted way to debug
issues (as in "self-inflicted issue") but I now at least see your
point.

-peter