<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Jann,<div class=""><br class=""></div><div class="">There’s the technical answer, and there’s the philosophical answer.</div><div class=""><br class=""></div><div class="">Philosophically, it was decided to use a separate port for TLS-secured and -mutually-authenticated communications between the IdP and the SP to enable usage of client-facing credentials on 443 without forcing their use in federated transactions.</div><div class=""><br class=""></div><div class="">This is how early versions of Shibboleth worked, and many SSO protocols still work this way. There are serious deployment burden downsides to the use of the back channel, but there are also very important use cases that it makes possible.</div><div class=""><br class=""></div><div class="">That specific binding advertises that your IdP is ready, willing and able to answer SAML 2.0 AttributeQuery requests issued directly by SP’s to that endpoint. Whether that’s true or not gets into the wiring you have behind it. The only firm recommendation is that your metadata must accurately represent the capabilities of your IdP.</div><div class=""><br class=""></div><div class="">For further exhumation:</div><div class=""><br class=""></div><div class=""><a href="https://spaces.internet2.edu/pages/viewpage.action?pageId=98306418#IdentityProviderDiscussionTopics(IdPv3)-8.TheBackChannelKoan" class="">https://spaces.internet2.edu/pages/viewpage.action?pageId=98306418#IdentityProviderDiscussionTopics(IdPv3)-8.TheBackChannelKoan</a></div><div class=""><br class=""></div><div class="">Take care,</div><div class="">Nate.</div><div class=""><br class=""><div class=""><div><blockquote type="cite" class=""><div class="">On Jun 3, 2016, at 21:30, Jann Malenkoff <<a href="mailto:jannmalenkoff@gmail.com" class="">jannmalenkoff@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class=""><div class="">There is a bit of a debate going on at or university.<br class=""><br class=""></div>What exactly is the following used for by the IdP?<br class=""><br class=""></div>If we use SAML2 - what is the purpose of the back-channel port 8443?<br class=""><div class=""><div class=""><div class=""><br class=""><AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"<br class=""> Location="<a href="https://example.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery" class="">https://example.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery</a>" /><br class=""></div></div></div></div>
-- <br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></div></div></body></html>