JAVA_OPTSenvironment variable (all ### is the amount of memory in megabytes to allow for the option):
maxPostSizeattribute. A size of about 100K (100000) is a reasonable choice.
Most new deployments without legacy needs will not need to support back-channel SOAP communication. The most common case requiring this feature is support for legacy Shibboleth SPs using SAML 1.1 that perform attribute queries using SOAP.
If you do need this support, these connections require special security properties which are not appropriate for user-facing/browser use. Therefore an additional endpoint must be configured.
For Tomcat 6, download tomcat6-dta-ssl-1.1.0.jar (asc) in to TOMCAT_HOME/lib/, or to use Tomcat 7 with the unofficial Unicon component, download tomcat7-1.1.jar.
Add the following connector definition to Tomcat's TOMCAT_HOME/conf/server.xml file for tomcat 6:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLImplementation="edu.internet2.middleware.security.tomcat6.DelegateToApplicationJSSEImplementation" scheme="https" maxPostSize="100000" SSLEnabled="true" clientAuth="want" keystoreFile="IDP_HOME/credentials/idp.jks" keystorePass="PASSWORD" />
or this one for tomcat 7:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" sslImplementationName="edu.internet2.middleware.security.tomcat7.DelegateToApplicationJSSEImplementation" SSLEnabled="true" scheme="https" secure="true" maxPostSize="100000" clientAuth="want" keystoreFile="IDP_HOME/credentials/idp.jks" keystorePass="PASSWORD" sslProtocol="TLS" />
IDP_HOMEwith the IdP home directory entered during installation.
PASSWORDwith the password for the IdP key entered during installation.
If you use this deployment method you do not need to do anything additional to deploy your application.
Normally you deploy web applications to Tomcat by copying the WAR file into the Tomcat
webapps/. However, when you do this Tomcat will explode the war (giving you idp.war and
webapps/) and then cache another version of the application in
work/Catalina/localhost/. This can lead to cases where you copy a new WAR into place but Tomcat continues to use the older version.
To address this, it is recommended that you use a context deployment fragment, which is just a small bit of XML that tells Tomcat where to get the WAR and provides some properties used when Tomcat load the application. This approach will also prevent those times when you create a new WAR and forget to copy it into Tomcat as this makes Tomcat load the war from
IDP_HOME/war/ where the installer places it.
Create the file
TOMCAT_HOME/conf/Catalina/localhost/idp.xml and place the following content in it (replacing
IDP_HOME with your IdP's home directory):
<Context docBase="IDP_HOME/war/idp.war" privileged="true" antiResourceLocking="false" antiJARLocking="false" unpackWAR="false" swallowOutput="true" />
You might also want to add
cookies="false" to the above Context Deployment Fragment, to prevent Tomcat from settting HTTP Cookies e.g. on MDUI Logos hosted at the IdP webserver, which would trigger Third Party Cookie warnings in some HTTP User Agents.