Apache mod_proxy, Jetty, and IDP endopint problem

[Cantor, Scott]

On 6/10/15, 4:23 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>Only reason I doubt my theory is that the log doesn't say anything about http://localhost:8080 or something like that. It has the right host and port, just the wrong transport. Is something else broken? Or does my theory seem right, and do I need to really use an https link between Apache and Jetty on localhost?

You shouldn't have to. Somebody else asked about that on the list, at which point I was reminded that they technically stopped supporting AJP. I think it still works for the time being, and that's still what I would argue for, but using the HTTP connector means it has to be virtualizable.

I agree with your suspicion. It ought to think the port is 8080 or whatever you set it to. But aside from that, the docs on doing the scheme override are here:

https://wiki.eclipse.org/Jetty/Howto/Configure_mod_proxy#Proxying_SSL_on_Apache_to_HTTP_on_Jetty

The way they claim to want to do it is odd, but they want you to have Apache push over a Header:

    RequestHeader set X-Forwarded-Proto "https" env=HTTPS

The alternative involves subclassing their connector in Java code and using that. I think we will at some point get one built and provide it because making people write code for this is dumb. This seems to be the one place they are behind Tomcat unfortunately. Jetty I think tends to be more commonly run stand alone than Tomcat.


-- Scott