Apache + Jetty 9 + IdP?

[Cantor, Scott]

On 4/14/15, 12:00 AM, "Derp Niner" <derpniner at gmail.com> wrote:


>
>I am curious for my own implementation - it seems that since v9 Jetty
>does not support proxying through apache with mod_proxy_ajp (see
>https://wiki.eclipse.org/Jetty/Howto/Configure_AJP13),

I registered my complaint with that poor decision, as have several other 
people. I doubt that it won't work or anything, but obviously it matters 
that they don't officially support it. If it turns out that Tomcat is the 
better choice for use with Apache, that's ok, but Tomcat's lack of support 
for the latest servlet specs without taking 5 minutes to start up really 
disqualifies it from production use for me, all other issues aside.

> but I noticed that the shib docs recommend AJP if using apache is 
>desired. I am
>curious for my own deployment - did your comment mean that you run
>jetty in production without a web server in front, or have you decided
>to run something different than apache?

Jetty is a web server (as is Tomcat of course). I don't use anything else 
with it, and haven't since 2011. It's a happy coincidence that this has 
coincided with the total collapse of OpenSSL's security (Heartbleed, etc.)

The only security bug that was disclosed that would have affected me was 
actually ahead of the version I've been running, that was just luck.

> Could you offer any
>recommendations for someone like me who is deploying IdP for the first
>time and is willing to try any type of setup?

I can only go by my own experience. Running without Apache has been fine, 
and I haven't needed any of its features. Most of the tweaks I had to make 
are gone with Jetty 9 (I started with 7).

I can't stand Tomcat at this point, and I hate HTTP proxying even more, so 
at this point I don't have a lot of choices because of the mistake the 
Jetty team made with that. They tend to be reasonable and it's possible 
they might listen to input on it.

-- Scott