[JIRA] (IDP-1900) X509ProxyFilter expecting new lines in certificate

[Vojtech Sassmann (Jira)]

Vojtech Sassmann ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5f2d07525227f50014ec8a39 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiZmZkMjNjNmI4NWNlNDBiMWI0YjBkMjQ4ZDExNDc0YTYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1900?atlOrigin=eyJpIjoiZmZkMjNjNmI4NWNlNDBiMWI0YjBkMjQ4ZDExNDc0YTYiLCJwIjoiaiJ9 ) IDP-1900 ( https://shibboleth.atlassian.net/browse/IDP-1900?atlOrigin=eyJpIjoiZmZkMjNjNmI4NWNlNDBiMWI0YjBkMjQ4ZDExNDc0YTYiLCJwIjoiaiJ9 ) X509ProxyFilter expecting new lines in certificate ( https://shibboleth.atlassian.net/browse/IDP-1900?atlOrigin=eyJpIjoiZmZkMjNjNmI4NWNlNDBiMWI0YjBkMjQ4ZDExNDc0YTYiLCJwIjoiaiJ9 )

Issue Type: Bug Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Authentication Created: 25/Jan/22 9:20 AM Priority: Trivial Reporter: Vojtech Sassmann ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5f2d07525227f50014ec8a39 )

The `X509ProxyFilter` reads PEM certificates from HTTP headers which are sent from Apache proxy. However, when configured, the filter throws IO Exception error. The problem is with parsing the PEM certificates. The parses expects new line after the ---- BEGIN CERTIFICATE --- and before the ---- END CERTIFICATE -----. However, these new lines are not sent from the Apache (and as far as I can tell, the Apache cannot be configured to do so).

I tried to use a modified version of the filter which inserts the newlines into the received certificates, and it worked.

Here is my example configuration of the Apache
```
<Location /idp/Authn/X509>
SSLVerifyClient require
SSLVerifyDepth 5
SSLOptions +ExportCertData
RequestHeader set SSL_CLIENT_CERT "%

{SSL_CLIENT_CERT}

s"
RequestHeader set SSL_CLIENT_CERT_CHAIN_0 "%

{SSL_CLIENT_CERT_CHAIN_0}

s"
RequestHeader set SSL_CLIENT_CERT_CHAIN_1 "%

{SSL_CLIENT_CERT_CHAIN_1}

s"
RequestHeader set SSL_CLIENT_CERT_CHAIN_2 "%

{SSL_CLIENT_CERT_CHAIN_2}

s"
RequestHeader set SSL_CLIENT_CERT_CHAIN_3 "%

{SSL_CLIENT_CERT_CHAIN_3}

s"
RequestHeader set SSL_CLIENT_CERT_CHAIN_4 "%

{SSL_CLIENT_CERT_CHAIN_4}

s"
</Location>
```

Configuration of the filter:
```
<filter>
<filter-name>X509ProxyFilter</filter-name>
<filter-class>net.shibboleth.idp.authn.impl.X509ProxyFilter</filter-class>
<!-- Proxied header name for the leaf certificate -->
<init-param>
<param-name>leafHeader</param-name>
<param-value>SSL_CLIENT_CERT</param-value>
</init-param>
<!-- Space-separated list of proxied header names for chain certificates. -->
<init-param>
<param-name>chainHeaders</param-name>
<param-value>SSL_CLIENT_CERT_CHAIN_0 SSL_CLIENT_CERT_CHAIN_1 SSL_CLIENT_CERT_CHAIN_2 SSL_CLIENT_CERT_CHAIN_3 SSL_CLIENT_CERT_CHAIN_4</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>X509ProxyFilter</filter-name>
<url-pattern>/Authn/X509</url-pattern>
</filter-mapping>
```

( https://shibboleth.atlassian.net/browse/IDP-1900#add-comment?atlOrigin=eyJpIjoiZmZkMjNjNmI4NWNlNDBiMWI0YjBkMjQ4ZDExNDc0YTYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1900#add-comment?atlOrigin=eyJpIjoiZmZkMjNjNmI4NWNlNDBiMWI0YjBkMjQ4ZDExNDc0YTYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100189- sha1:c51f787 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220125/43eff508/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-f5773835-ef7f-4ba1-88fd-f9e100d9b795
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220125/43eff508/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-97709a3e-3a73-43ca-bf93-58286542da42
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220125/43eff508/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-8e73a133-3779-4ad7-81f9-1576791f61ca
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220125/43eff508/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-54d19c39-7955-4bea-9d2d-c5abfa5a8939
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220125/43eff508/attachment-0007.png>