Apache + Jetty 9 + IdP?

[John Dennis]

On 04/15/2015 07:19 AM, Peter Schober wrote:
> * John Dennis <jdennis at redhat.com> [2015-04-14 17:01]:
>> However there may be times where you still want to front your
>> application server with Apache because Apache has a much richer suite of
>> extensions (including authentication modules). In this case you have to
>> pass REMOTE_USER and friends in the HTTP headers and extract them in a
>> HttpServletRequestWrapper so that you overload getRemoteUser(),
>> getAuthType(), etc. You also have to very carefully secure the
>> connection between Apache and Jetty and establish a trusted port over
>> which the proxy will occur, otherwise a malicious entity could perform a
>> man-in-the-middle attack and modify the REMOTE_USER which the servlet
>> implicitly trusts. I have code a write-up (targeted at another project)
>> on how to do this. But you probably don't want to go there unless you
>> have to, I'd strongly recommend just running Jetty.
> 
> All this applies when using the Shibboleth Service Provider software
> (a module for httpd, among others) with an application run on Jetty,
> of course.
> Short version seems to be to avoid Jetty 9 for such applications, if
> possible.

No, that is not the right interpretation. It has nothing to do with SP's
nor specific applications. Rather the issue is how you architect your
authentication and identity infrastructure with the goal of insulating
applications from authentication and identity complexities. There is a
school of thought which says at this moment in time Apache has more
diverse functionality and is already a well understood and widely
deployed technology in an enterprise. Therefore centralize the
complexity of authentication and identity in one well supported location
and simply forward the results to an application running in a J2EE
container that is otherwise ignorant of how this was accomplished.

The problem of ECP client authentication was perhaps a less than ideal
example of this architecture but everything said still applies. The lack
of AJP support in Jetty 9 definitely makes this architecture more
difficult. IMHO it was a poor decision on the part of the Jetty devs to
remove this feature.


-- 
John