aacli error

[Peter Schober]

* Donald Lohr <lohrda at jmu.edu> [2021-07-15 22:20]:
> (http://localhost/idp/profile/admin/resolvertest?requester=*removed url for
> this email*&principal=lohrda&saml2) Connection refused (Connection refused)

Personally I've configured Tomat (as that's what I'm using with the
IDP) to listed on port 80 -- on the loopback interface *only*.
Then none of the IDP tools need any further setup.

(Pretty much the same thing can be achieve by listening on all
interfaces and then making sure packet filters and firewalls prevent
any access to port 80 from the outdide, only with more work.)

Now if someone has port 80 disabled globally (which I find overly
drastic, loopback shouldn't hurt) then you'd have to change the port
and protocol the IDP tools connect to by means of setting the right
parameters.

If you need to use TLS to speak to localhost (which is a bit silly)
you can do that. In the simplest case by using the hostname that's
actually in the certificate (avoiding the need to first use TLS and
then disable PKIX in order to be able to connect to localhost, which
is not in the certificate, of course) instead of "localhost".
(Make sure the full hostname is at least in your hosts file, then, as
to not incur DNS lookups for that, too, which, again, is a bit silly.)

-peter