<div dir="ltr"><div>So I noticed in an article from the SWITCH federation that their configuration procedure for a Shibboleth IDP is to have Tomcat accepting secure traffic on port 443 (HTTPS) and 8443. They suggest 443/HTTPS should be used for the SSO Endpoints in your IDP's Metadata serving a certificate that is signed by a reputable certificate authority. Whilst 8443 should be accepting traffic for your Attribute Resolution/Authority Endpoints and serving a self-signed certificate.<br>
<br></div>I see this does seem to be a trend with other Identity Providers in InCommon federation metadata but I haven't seen a documented technical reason why you shouldn't just use the same port and certificate for all of your endpoints? So my questions is simply -- why? I'd like to understand this better.<br>
<br>Here's the referenced SWITCH article: <a href="https://www.switch.ch/aai/docs/shibboleth/SWITCH/latest/idp/deployment/#overview">https://www.switch.ch/aai/docs/shibboleth/SWITCH/latest/idp/deployment/#overview</a><div>
<div><div><font face="tahoma, sans-serif"><div><font face="tahoma, sans-serif"><br></font></div>Joshua Riffle</font><div><font face="tahoma, sans-serif">Software Engineer<br></font><div><font color="#CC0000" face="tahoma, sans-serif"><b>Azusa Pacific University</b></font></div>
</div></div>
</div></div></div>