[JIRA] (IDP-1931) Update windows installer to Jetty 10.0.9

[Matt Borja (Jira)]

Matt Borja ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=6246cc2ea629c30068a5aea7 ) *commented* on IDP-1931 ( https://shibboleth.atlassian.net/browse/IDP-1931?atlOrigin=eyJpIjoiZDA1YTMyZDVlYjk3NDA3NTliZDk2ZmJjM2U4M2ViZWQiLCJwIjoiaiJ9 )

Re: Update windows installer to Jetty 10.0.9 ( https://shibboleth.atlassian.net/browse/IDP-1931?atlOrigin=eyJpIjoiZDA1YTMyZDVlYjk3NDA3NTliZDk2ZmJjM2U4M2ViZWQiLCJwIjoiaiJ9 )

Rod Widdowson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977 ) I’m getting a HTTP 400 “Invalid SNI” now being thrown by Jetty. Not 100% sure, but it seems to coincide with us including the update to Jetty 10.0.9 when we recently upgraded to 4.2.x.

I believe our topology (clustered) may have something to do with it:

*user agent →* *idp.host.tld* ( http://idp.host.id ) (reverse proxy) *→ any origin server* (i.e. idp01.internal.tld, idp02.internal.tld, idp03.internal.tld, …, idpN.internal.tld)

While origin servers in the cluster have their own FQDN on the network, they’re actually configured to service requests made out to *idp.host.tld* and not their own FQDN. So, when I attempt to hit */idp/shibboleth* using the node’s own FQDN, I get the above HTTP 400 “Invalid SNI” error; and so does the reverse proxy (load balaner) when it goes to perform its health check against the node, which in turn causes that node to get marked as OFFLINE, resulting in a denial of service.

Previous version of Jetty didn’t seem to exhibit this issue and I’m having trouble tracking down information on where/how to disable SNI for this specific environment.

Thoughts?

( https://shibboleth.atlassian.net/browse/IDP-1931#add-comment?atlOrigin=eyJpIjoiZDA1YTMyZDVlYjk3NDA3NTliZDk2ZmJjM2U4M2ViZWQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1931#add-comment?atlOrigin=eyJpIjoiZDA1YTMyZDVlYjk3NDA3NTliZDk2ZmJjM2U4M2ViZWQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/fac0c63b/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-e0e166db-dc6c-4243-ba98-deae724b5e97
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/fac0c63b/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-eb7be445-bcd5-4c7c-a2c8-8a242bbd579f
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/fac0c63b/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-4338e7f0-95cb-4a20-a969-286afac6cdb3
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220422/fac0c63b/attachment-0005.png>