AJP proxy of request environment

[Chad La Joie]

On Fri, Jul 20, 2012 at 3:22 PM, Russell Beall <beall at usc.edu> wrote:
> Has anyone found a way around that besides switching over to Jetty
> completely?

Nothing you can do.  This is Tomcat working as expected.

> ---
>
> On another angle for this issue, I have been having trouble getting the
> Jetty maven plugin to properly use the AJP connector.  The last version
> available from mortbay has a bug which causes the AJP connection to fail
> intermittently.  They fixed the bug in 6.1.27 but never released that
> version, so the 6.1.26 version is the last available before it went to the
> Eclipse foundation.  When I try various version from the Eclipse foundation,
> I cannot even load the AJP connector in many of the recent releases.  I
> finally found one that works, and also does not seem to have the AJP bug,
> and this is version 7.2.2.v20101205

Why are you trying to use the maven plugin?

> Since the Shib project is switching to recommending Jetty, I wanted to move
> in this direction, but their documentation about AJP seems to indicate they
> think it should not be used, and so they probably aren't giving it the
> attention it deserves.

> Is there a way to use the HTTP proxy, which is what the Jetty documentation
> highly recommends, and still keep the data secure and free of potential
> spoofing?  I couldn't seem to proxy any request attributes this way, but
> only headers.

Well, the HTTP proxy method isn't any more or less secure than the AJP
protocol.  In both cases you have to trust that there is no MITM.  I
believe their (the Jetty team's) thinking is simply that they have to
support HTTP anyways so why support yet another protocol as well?

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered