I've created Nabble archives of the CF lists here: http://cf-bosh.70367.x6.nabble.com/ http://cf-dev.70369.x6.nabble.com/ http://cf-lattice.70370.x6.nabble.com/ The archives are searchable and allow w

Would the same user logging in via SAML and LDAP result in two different UAA user objects with different sources, so that the user would have two different sets of orgs/spaces/apps? Aaron -- View this

That’s the main concern we have as well – we currently need LDAP for the CLI since SAML doesn’t work in that case, but we’d like SAML for web-based interactions (SSO in a portal, etc.). But at present

In our case we use email address as the username via LDAP as well (UPN actually, but same thing) so it would be the same. Is there a timeline for the ECP profile support? Aaron Sent: Wednesday, May 13

You can use the allow_host_access property in your manifest to enable the access. It simply suppresses the iptables rule you mention that rejects the traffic. https://github.com/cloudfoundry/cf-releas

I can certainly confirm that for Intel this feature would be required for us to use ssh/scp access at all, and maybe not even then. We've been selling Cloud Foundry to our security folks as a huge imp

Not sure I understand that. When you get a token you also automatically get a refresh token - are you saying the refresh token given isn't valid and we have to generate a new refresh token as an admin

So we're just using the cf client which doesn't have a secret defined, is that why we need to use the admin client? -- View this message in context: http://cf-dev.70369.x6.nabble.com/cf-dev-CF-UAA-Ref

We've started testing Windows apps on Diego in our lab and everything appears to be working correctly except for occasional crashes of the .NET apps. The frequency is very random - some times I can go

The app is just a simple one page test app we've been using since we landed Iron Foundry, here is the content in our default.aspx: <%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.asp

I shut off the healthcheck via the CLI and then started a separate process calling healthcheck.exe on my test servers after setting the port environment variable: Looking at the data from running all

Also just occurred to me - what if the page returns a 302, 401, or 404? I'm guessing it would make the healthcheck fail because it wouldn't be a match against Result.IsSuccessStatusCode. :-( Aaron --

I agree with your root argument that the port check doesn't really address application health and it's easy to push a non-working app and have the healthcheck still pass. My argument is that is exactl

Just to clarify as well why I think this is so important - a majority of apps on our internal platforms require authentication and will return a 401 on the root page, making them unusable on Diego for

My concern is that the HTTP check (mislabeled as "port") would still be the default and I'd have to expect users to opt out of it per app. It's confusing and not what users of the platform have come t

Yes, I agree that setting the specific URI to check would be necessary as well so that developers could avoid some of the other concerns. So the ones I can think of: * URI / endpoint * Expected status

Just as a reference you could look at some of the connection tests that Monit allows: https://mmonit.com/monit/documentation/monit.html#CONNECTION-TESTING Obviously there are quite a few there so it m

Based on this discussion, where are we on the priority of switching the current "port" check for the Windows lifecycle back to actually be a port check? I get the impression that the changes to suppor

I understand what you're trying to avoid, I just think that is actually the normal case for the port healthchecks. Nothing on the Linux or Docker side ever touches the app so it's entirely possible it

It will totally depend on the app/buildpack. For example, the static file buildpack and PHP buildpack just launch Nginx and then host the application inside it. As soon as the web server is up it will