Apache + Jetty 9 + IdP?

[Derp Niner]

Thanks very much! I will try it without apache (and hope that
management approves).

On Mon, Apr 13, 2015 at 8:13 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 4/14/15, 12:00 AM, "Derp Niner" <derpniner at gmail.com> wrote:
>
>
>>
>>I am curious for my own implementation - it seems that since v9 Jetty
>>does not support proxying through apache with mod_proxy_ajp (see
>>https://wiki.eclipse.org/Jetty/Howto/Configure_AJP13),
>
> I registered my complaint with that poor decision, as have several other
> people. I doubt that it won't work or anything, but obviously it matters
> that they don't officially support it. If it turns out that Tomcat is the
> better choice for use with Apache, that's ok, but Tomcat's lack of support
> for the latest servlet specs without taking 5 minutes to start up really
> disqualifies it from production use for me, all other issues aside.
>
>> but I noticed that the shib docs recommend AJP if using apache is
>>desired. I am
>>curious for my own deployment - did your comment mean that you run
>>jetty in production without a web server in front, or have you decided
>>to run something different than apache?
>
> Jetty is a web server (as is Tomcat of course). I don't use anything else
> with it, and haven't since 2011. It's a happy coincidence that this has
> coincided with the total collapse of OpenSSL's security (Heartbleed, etc.)
>
> The only security bug that was disclosed that would have affected me was
> actually ahead of the version I've been running, that was just luck.
>
>> Could you offer any
>>recommendations for someone like me who is deploying IdP for the first
>>time and is willing to try any type of setup?
>
> I can only go by my own experience. Running without Apache has been fine,
> and I haven't needed any of its features. Most of the tweaks I had to make
> are gone with Jetty 9 (I started with 7).
>
> I can't stand Tomcat at this point, and I hate HTTP proxying even more, so
> at this point I don't have a lot of choices because of the mistake the
> Jetty team made with that. They tend to be reasonable and it's possible
> they might listen to input on it.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net