<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I’d like to setup a Shibboleth 2.4 IdP behind a hardware-based load balancer (I think the vendors are calling them Application Delivery Controllers now). I’ve read the wiki on IdPClusterIntro and the IdPApacheTomcatPrepare. I’d like all traffic to the load balancer be encrypted and the connections from the load balancer to the IdP to be unencrypted. Also, I’d like the only connections to the IdP to come from the load balancer.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">My reading of IdPApacheTomcatPrepare seems to indicate that this is not possible and that there are instances when the SP and the IdP communicate directly. Is this so? </div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Finally, given my proposed configuration, is it possible that I only need to configure tomcat to open an endpoint on port 8080 (for example)?</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Thank you very much </div><br><div id="bloop_sign_1397749824775183872" class="bloop_sign"><span style="font-family:helvetica,arial;font-size:13px"></span>-- <br>Michael Dahlberg<br></div></body></html>