AJP proxy of request environment

[Cantor, Scott]

On 7/20/12 5:21 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>I thought Jetty was being recommended as the container for production
>use.  If it is not, then I'll stick with Tomcat in production.

The IdP is moving that way, yes. The SP has nothing to say about Java
containers at all. It's just two different things. If you're putting the
SP in front of the IdP, then I guess there's a relationship.

>However, I was not discussing Apache --> Java container connection issues
>in relation to the IdP in this message.  I am asking about how it should
>work with an SP in front of a Java application.

Yes, which doesn't really involve any of the project's decisions about
Java container support.

>The maven plugin allows for a development servlet to run directly out of
>the project without having to deploy a war file elsewhere.  I have used
>this both in application development as well as testing IdP plugins from
>an IdP run directly from the command "mvn jetty:run"

I guess it's not that surprising that something like that wouldn't want
Apache in the middle.

>So with this info, and the response that Chad made a moment ago, it
>appears that I can send headers into a Java application with the same
>level of security as using AJP and it doesn't really matter which one I
>choose.

I wouldn't say "same", but I use headers if I have to just like anybody
else. The wiki and jira use it at the moment because of the plugin
limitations and I haven't deemed it worth trying to fix the plugins.

>If this is the case, then why does the SP documentation recommend against
>"ShibUseHeaders On" in favor of using AJP and setting the variables to
>have the "AJP_" prefix which causes them to be forwarded as request
>attributes to the application?

Because it's never the right thing to use a mechanism that can potentially
be vulnerable vs. one that's guaranteed not to be, if the effort is
reasonably similar.

>The wording on this in the documentation has gotten even stronger since
>last I read it which is why I decided I'd better understand what was
>going on.  Prior to this I have been telling departments to use
>"ShibUseHeaders On" so that the data shows up to their application, since
>I couldn't advise them on how to do it with environment variables.

I haven't made any particular attempt to police what my campus does with
it, I leave that to people to decide.

I made the wording stronger because people had proven that the AJP_ trick
worked and that means it should always be used when it can, since it's
just common sense.

I would say that I personally would have a bias against any container that
didn't support AJP for a lot of reasons, but if I just couldn't take
Tomcat anymore and wanted to use Jetty, I wouldn't feel that concerned
about it on Apache. IIS is not quite as robust about header encoding
variability and I had to do a lot more work to block spoofing for it.

>> 
>>You may be able to generate proxied headers from environment variables,
>> but I don't know for sure.
>
>Nope.  Wasn't talking about some special case like this, just the
>standard "to use headers, or not to use headers" quandaryŠ

I just meant that if you had to use HTTP proxying, then there might be a
way to get the better security of not using headers anyway. The proxying
step itself can never be allowed to have a MITM. That's game over no
matter what.

-- Scott