<div dir="ltr"><div><div><div>Hi. Yep, I just finished setting up a couple of IdPs, one with Apache + Tomcat, and another with Tomcat alone, the later following your guide.<br><br></div>The errors in catalina.out are gone and both work nicely. And you're right, it's more simple / easy to use Tomcat alone. I got a bit confused with the configuration instructions, trying to "complete" the SWITCH configuration with bits from the Shib guide... but it's clear for me now.<br><br></div>Thanks again.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2014-09-16 10:39 GMT-05:00 Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Christian Munive <<a href="mailto:christian.munive@gmail.com">christian.munive@gmail.com</a>> [2014-09-16 16:19]:<br>
<span class="">> I see... thanks Peter. Yeah, I was trying to follow these instructions:<br>
><br>
> <a href="https://www.switch.ch/aai/docs/shibboleth/SWITCH/latest/idp/deployment/" target="_blank">https://www.switch.ch/aai/docs/shibboleth/SWITCH/latest/idp/deployment/</a><br>
><br>
> But also including the instructions from the main site:<br>
><br>
> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare</a><br>
<br>
</span>Yeah, you can't combine those. The SWITCH guide uses httpd (and is<br>
complete/sufficient by itself), the Shib wiki only has the<br>
instructions to add SOAP support to Tomcat when using Tomcat solo<br>
(there's your conflict with httpd and the SWITCH docs).<br>
The Shib wiki also does not detail setting up TLS/SSL for port 443<br>
(since this is not Shib specific).<br>
<br>
If you want to try or compare yet another set of third party<br>
documentation (for Tomcat solo, incl TLS setup) have a look at my own:<br>
<a href="https://wiki.univie.ac.at/display/federation/Shibboleth+IDP+2.4" target="_blank">https://wiki.univie.ac.at/display/federation/Shibboleth+IDP+2.4</a><br>
Concact me off-list for any questions about that, of course.<br>
<span class=""><br>
> I just tried what you recommended (using the port 443 only) and the<br>
> problem went away.<br>
<br>
</span>I did not say anything that amounts to "using the port 443 only":<br>
For Tomcat+httpd you'd use Tomcat on port 8009 only, and let httpd<br>
proxy and serve 443 and 8443.<br>
For Tomcat solo you'd serve 443 and 8443 from Tomcat itself.<br>
<span class=""><br>
> I'll give it a thought and see which port / configuration might be<br>
> the better one.<br>
<br>
</span>Somewhat academic, but things to consider:<br>
<br>
* 2 servers (Tomcat+httpd) needed for 1 purpose vs. 1 server (Tomcat solo):<br>
<br>
* ease of running the JVM as non-root (also depends on<br>
OS/distribution; it's trivial on Debian/Ubuntu; I have a locally<br>
rolled SRPM for authbind if you wanted to have the same on RHEL-like<br>
systems):<br>
<br>
* ease of configuring TLS/SSL (though with PKCS#12 support in Tomcat<br>
the pain of managing JKS goes away, see my documention above):<br>
<br>
* versions of Tomcat available through package management (for<br>
security updates) in the OS/distribution you're using, and the<br>
availability of the DelegateToApplication extension for Tomcat:<br>
<br>
* easy of adding container-based authentication for ECP<br>
<br>
These are the main points, I feel.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>