Shibboleth Developers

["Scott Cantor" <>]

> Don't know if that's the issue here, but could be.  Maybe the Tomcat
> SSL/TLS config is causing Tomcat to require the cert (from the browser
> perspective), as where our standard Apache config doesn't?

I think that's the key point here. Can Tomcat have different client auth
rules for different ports?

Regardless, should this be "fatal" anyway? My client auth rule doesn't fail
a request if it can't validate the cert, it just doesn't set the secure flag
in the policy for that request.

-- Scott