back-channel on front-channel port

[Bergmann, Clemens]

Hi,

 

I am currently configuring a new Shibboleth IdP. To reduce coordination requrements I would like to use standard Port 443 for front- and back-channel requests.

[1] states “It's possible to host these SOAP services on the same port as the rest of the IdP's services and this is usually recommended nowadays”.

Unfortunately I could not find instructions on how to follow this recommendation. 

Is it sufficient to add the following block to the Apache configuration or is there more to it?

  <LocationMatch "/idp/profile/SAML(1|2)/SOAP/(ArtifactResolution|SLO|AttributeQuery)">

    # Diese drei SSL-Optionen sind zwingend notwendig

   # damit SP-Abfragen auf diesen Port funktionieren!

    # Details siehe Shibboleth-Wiki

    SSLVerifyClient       optional_no_ca

    SSLVerifyDepth        10

   SSLOptions            +StdEnvVars +ExportCertData

  </LocationMatch>

 

[1] https://wiki.shibboleth.net/confluence/display/IDP4/SecurityAndNetworking

 

Kind Regards

Clemens Bergmann

-- 

Clemens Bergmann

Gruppe Nutzermanagement und Entwicklung

Technische Universität Darmstadt

Hochschulrechenzentrum, Alexanderstraße 2, 64289 Darmstadt

Tel. +49 6151 16 71184

 <http://www.hrz.tu-darmstadt.de/> http://www.hrz.tu-darmstadt.de/

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210628/23a3d9c9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6377 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210628/23a3d9c9/attachment.p7s>