Changes between Version 12 and Version 13 of IdPFreshInstall

Timestamp:

01/05/15 16:20:42 (10 years ago)

Author:

dabantz@…

Comment:

--

IdPFreshInstall

@@ -14 +14 @@
 [[https://wiki.shibboleth.net/confluence/display/SHIB2/IdPApacheTomcatPrepare|Preparing Apache Tomcat for the Shibboleth Identity Provider]]
 
+=== Configuring Tomcat connector & security ===
+Tomcat configuration appears to be very version dependent.  That is, the same configuration statements in one version of Tomcat will not work properly in another.  So some research and updating is needed for each new version of tomcat.
+
+The UA IdP as of 2015-01 is using tomcat version 6.  For that version, we configured tomcat to respond on secured port 8444 [IdP runs as tomcat so must use high-numbered port] with the following configuration snippet in the tomcat directory (/opt/tomcat/conf/server.xml on the UA IdP servers) as of 2015-01:
+{{{
+<Connector port="8444" 
+    protocol="HTTP/1.1" 
+    SSLEnabled="true" 
+    maxThreads="150" 
+    scheme="https" 
+    secure="true" 
+    clientAuth="false" 
+    sslProtocols="TLSv1,TLSv1.1,TLSv1.2"
+    ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA"
+    keystoreFile="/opt/shibboleth-idp/credentials/idp.alaska.edu.jks" 
+    keystorePass="••••••••••••" />
+
+}}}
+This limits ciphers to those supported in the installed JDK version and considered safest by [https://www.ssllabs.com/sslltest/analyze.html| Qualsys SSL Labs].
+This configuration does not support PFS; that will require an update to tomcat and JDK. 
 
 === Install Compatible JDK - Open JDK ===