Handle HTTPS and HTTP to same IIS Web Site

[Alexander F. French]

Thanks for the followup Peter. The conversation did veered off a bit that it would be easy to lose track of, as I tried to be responsive to questions/suggestions from you and Todd, but maybe lost the whole initial thread long the way.

Like a zillion other choices, I think my organization generally choosing to do SSL-offload to the load balancer simplifies some things, but creates new conundrums too.  Not big problems, just minor differences from the product Shibboleth is replacing- a change I'm generally pretty psyche about.

Thanks,
Alex

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, January 31, 2018 6:51 AM
To: users at shibboleth.net
Subject: Re: Handle HTTPS and HTTP to same IIS Web Site

* Peter Schober <peter.schober at univie.ac.at> [2018-01-31 12:32]:
> > With the semi-packaged application I primarily support and integrate 
> > with, there have been an unfortunate number of times in the last few 
> > years when thorny problems have involved needing to look in detail 
> > at network traffic and Windows ProcMon activity to prove to vendors 
> > that their logging is inadequate or just plain incorrect.
> 
> Since this is the Shibboleth mailing list the only thing of relevance 
> here is Shibboleth behaviour and debugging of (mainly) SAML protocol 
> messages. And all of the details you'd need to debug issues here can 
> be logged by the Shibboleth software (and sometimes web server 
> software).
> So claiming you need to break or avoid TLS to the server is silly, IMO.
> 
> If you're talking about other aspects of your application stack, well, 
> then this has nothing to do with this list.

I'll have to take that back. I think I now understand that you're routinely trying to replicate some application issues by avoiding TLS, and that the issues you're trying to debug have nothing to do with Shibboleth or SAML. But the fact that the server is protected by Shibboleth/SAML makes your chosen approach difficult/impossible.

With Apache httpd there's no issue with protecting multiple vhosts on multiple ports (80 vs 443) speaking multiple protocols (HTTP vs HTTPS). Besides server configuration you'd have to amend the SAML metadata to add plain HTTP protocol endpoints, of course.
I don't have anything to offer wrt MS-IIS, though.

So I still think that that's a needlessly complicted way to debug issues (as in "self-inflicted issue") but I now at least see your point.

-peter
--
For Consortium Member technical support, see https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CAlexander.F.French%40dartmouth.edu%7Cbc8ffddfc20f451e314508d568a0f1af%7C995b093648d640e5a31ebf689ec9446f%7C0%7C0%7C636529962822118752&sdata=hDa4OYzr5oZL8nMgsWkvqshAuiUipl2c%2Bw%2FfzWOCSh0%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net