Apache mod_proxy, Jetty, and IDP endopint problem

[Wessel, Keith]

Thanks so much, to both of you. And thanks, Jim, for the remote user suggestion. I was wondering how I was going to do that. The remote user support in V3 makes it look olike it should be quite simple to pull that out of the header. As is always the question with header vars, is that method secure?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Jim Fox
Sent: Wednesday, June 10, 2015 5:15 PM
To: Shib Users
Subject: Re: Apache mod_proxy, Jetty, and IDP endopint problem


Jetty definitely dropped AJP with version 9.  Judging from their talk I
don't expect to see it back.

I happen to like apache in front of things.  It does all the cryption and it 
provides mod_rewrite.  I couldn't live without the latter.

I've gotten sidetracked by a big Workday conversion going on here, but
this is generally how I expect to use jetty 9 and apache with http proxying.

For the https->http conversion I use:

   RequestHeader set X-Forwarded-Proto "https" early

To get a REMOTE_USER to the Idp:

   RewriteEngine On
   RewriteCond %{LA-U:REMOTE_USER} (.+)
   RewriteRule . - [E=RU:%1]
   RequestHeader set REMOTE-USER %{REMOTE_USER}s

and then configure the idp to get remoteuser from the header.


Something like that.

Jim



On Wed, 10 Jun 2015, Cantor, Scott wrote:

> Date: Wed, 10 Jun 2015 15:07:52
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> To: Shib Users <users at shibboleth.net>
> Reply-To: Shib Users <users at shibboleth.net>
> Subject: Re: Apache mod_proxy, Jetty, and IDP endopint problem
> 
> On 6/10/15, 6:05 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:
>
>> Thanks, Scott. I had just added mod_proxy_ajp before you replied, planning to go that route. I didn't know Jetty was dropping support for it. Inyour opinion, is mod_proxy_http (with one fix or another) going to be the better route? Or is there a good reason to go with mod_proxy_ajp that outweighs it being phased out?
>
> I guess my personal opinion is that until something actually breaks AJP is so much better that it's worth the risk, but it does mean worrying about it every major upgrade. Really a personal call, I just hate proxying with the fire of a billion suns.
>
> Caveat: I'm not doing either, I run Jetty alone, since 2011.
>
> -- Scott
>
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net