AJP proxy of request environment

[Russell Beall]

Hi,

I've recently been working further with proxying the shib data to Tomcat/Jetty using the AJP_ prefix instead of using application headers.

Jetty seems to allow me to list through the attributes and print them out using request.getAttributeNames followed by a get of the value for each name.

Tomcat doesn't seem to provide any of the attributes in this manner, and it was extremely frustrating to find no data transmitted until I finally figured out that the data was actually being transmitted but was not being provided via the request.getAttributeNames() API.

It seems that this was a design decision for certain specific performance reasons.  The attribute names and values do exist in the request if I explicitly call them by name, but the names are not being provided in the enumeration.

Has anyone found a way around that besides switching over to Jetty completely?

---

On another angle for this issue, I have been having trouble getting the Jetty maven plugin to properly use the AJP connector.  The last version available from mortbay has a bug which causes the AJP connection to fail intermittently.  They fixed the bug in 6.1.27 but never released that version, so the 6.1.26 version is the last available before it went to the Eclipse foundation.  When I try various version from the Eclipse foundation, I cannot even load the AJP connector in many of the recent releases.  I finally found one that works, and also does not seem to have the AJP bug, and this is version 7.2.2.v20101205

Since the Shib project is switching to recommending Jetty, I wanted to move in this direction, but their documentation about AJP seems to indicate they think it should not be used, and so they probably aren't giving it the attention it deserves.

If I am understanding this correctly however, AJP would be critical to the security of passing request data to a Java application behind an SP in Apache because using the application headers is subject to spoofing.

Is there a way to use the HTTP proxy, which is what the Jetty documentation highly recommends, and still keep the data secure and free of potential spoofing?  I couldn't seem to proxy any request attributes this way, but only headers.

Thanks,
Russ.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120720/66f969f8/attachment.html