Apache + Jetty 9 + IdP?

[Peter Schober]

* John Dennis <jdennis at redhat.com> [2015-04-14 17:01]:
> However there may be times where you still want to front your
> application server with Apache because Apache has a much richer suite of
> extensions (including authentication modules). In this case you have to
> pass REMOTE_USER and friends in the HTTP headers and extract them in a
> HttpServletRequestWrapper so that you overload getRemoteUser(),
> getAuthType(), etc. You also have to very carefully secure the
> connection between Apache and Jetty and establish a trusted port over
> which the proxy will occur, otherwise a malicious entity could perform a
> man-in-the-middle attack and modify the REMOTE_USER which the servlet
> implicitly trusts. I have code a write-up (targeted at another project)
> on how to do this. But you probably don't want to go there unless you
> have to, I'd strongly recommend just running Jetty.

All this applies when using the Shibboleth Service Provider software
(a module for httpd, among others) with an application run on Jetty,
of course.
Short version seems to be to avoid Jetty 9 for such applications, if
possible.
-pter