<div dir="ltr"><div><div>I see... thanks Peter. Yeah, I was trying to follow these instructions:<br><br><a href="https://www.switch.ch/aai/docs/shibboleth/SWITCH/latest/idp/deployment/">https://www.switch.ch/aai/docs/shibboleth/SWITCH/latest/idp/deployment/</a><br><br></div>But also including the instructions from the main site:<br><br><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare</a><br><br></div><div>I just tried what you recommended (using the port 443 only) and the problem went away. I'll give it a thought and see which port / configuration might be the better one.<br><br></div><div>Oh, and I configured a CDS to practice and learn a bit. It might be implemented in the end (probably not), but now I have some idea of how to make it work, just in case.<br><br></div><div>Thanks for your help guys.<br><br><br></div><div>Christian Munive.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2014-09-16 4:50 GMT-05:00 Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Chrsitian,<br>
<br>
* Christian Munive <<a href="mailto:christian.munive@gmail.com">christian.munive@gmail.com</a>> [2014-09-16 00:28]:<br>
<span class="">> I'm using the recommended library "tomcat6-dta-ssl-1.0.0.jar" for<br>
> SOAP endpoints.<br>
<br>
</span>Seems you're following two different (and incompatible) sets of<br>
instructions, and trying to merge them into one system.<br>
<br>
You'll have to decide whether you want Apache httpd in the mix or<br>
not. The above extension for Apache Tomcat is only needed if you don't<br>
have httpd running at all and instead rely on Tomcat as a webserver on<br>
both ports 443 /and/ 8443.<br>
<br>
Either way will work: The dta extension allows to run only one server<br>
process (Tomcat) instead of two (Tomcat and httpd) but is only<br>
officially supported for Tomcat6 (although there's a contributed<br>
extension for Tomcat7 that seems to work just fine).<br>
Getting authentication for ECP set up seems a bit easier with httpd in<br>
front, but can also be done with Tomcat solo.<br>
<br>
In any case you'll have to either remove httpd from the mix and<br>
configure Tomcat for https on port 443 also (i.e., running only<br>
Tomcat) /or/ remove all connectors from Tomcat's server.xml except the<br>
AJP one on port 8009, and restart both httpd and Tomcat (running httpd<br>
on all external ports, and Tomcat only internally).<br>
The second variant seems a bit easier given your existing configuration.<br>
<br>
Best regards,<br>
-peter<br>
<div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>