AJP proxy of request environment

[Cantor, Scott]

On 7/20/12 3:22 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>It seems that this was a design decision for certain specific performance
>reasons.  The attribute names and values do exist in the request if I
>explicitly call them by name, but the names are not being provided in the
>enumeration.
>
>Has anyone found a way around that besides switching over to Jetty
>completely?

Is that really a requirement in general? Other than for debugging, what's
the use case?

>Since the Shib project is switching to recommending Jetty, I wanted to
>move in this direction, but their documentation about AJP seems to
>indicate they think it should not be used, and so they probably aren't
>giving it the attention it deserves.

I'm not sure what the issue is, but I don't know what the maven plugin is
for. AFAIK, they support AJP connectivity, but I don't actually run it
that way myself, and the switch to Jetty is certainly not focused on a use
case involving the SP or Apache in front of the IdP.

>If I am understanding this correctly however, AJP would be critical to
>the security of passing request data to a Java application behind an SP
>in Apache because using the application headers is subject to spoofing.

That doesn't really have anything to do with the IdP, though, and that's
the Java component that is focused on Jetty.

And, FWIW, it's not subject to spoofing, it's at risk to bugs in the
protection against spoofing if a server or API changes the way they handle
headers. Anybody is welcome to try attacking it any time.

>Is there a way to use the HTTP proxy, which is what the Jetty
>documentation highly recommends, and still keep the data secure and free
>of potential spoofing?  I couldn't seem to proxy any request attributes
>this way, but only headers.

You may be able to generate proxied headers from environment variables,
but I don't know for sure.

-- Scott