AJP, headers, security

[Philip Durbin]

Hello!

I have a Java application behind a Shibboleth SP (mod_shib).

>From the many warnings[1] I'm well aware that setting "ShibUseHeaders"
to "On" is strongly discouraged for security reasons.

However, setting ShibUseHeaders seems to be the only way I can
avoid[2] using AJP, which is my real goal. Put another way, rather
that using mod_proxy_ajp I'm trying to use mod_proxy_http. Rather than
using `ProxyPass / ajp://localhost:8009/` I'm trying to use `ProxyPass
/ http://localhost:8080/`.

In a commit[3] I just made I'm continuing to avoid using headers by
default in our app but now I allow I now allow the use of headers with
a configuration option I called called "ShibUseHeaders". I wrote up
the change at https://github.com/IQSS/dataverse/issues/2294

My hope is that no one will ever use this new "ShibUseHeaders"
configuration option I just introduced in our app. That is, I hope we
can get the application working well with AJP again. Assuming we need
to stop using AJP, however, here are my questions:

1. Am I right in thinking that to avoid using AJP I have to set
"ShibUseHeaders" to "On"?

2. Can anyone provide any guidance in how I could try to hack into my
application when "ShibUseHeaders On" is enabled? My hope is that the
application is secure from spoofing but I'd like to verify this of
course!

I've tried to summarize why we are trying to avoid using AJP at
https://github.com/IQSS/dataverse/issues/2180#issuecomment-116801203

Thanks in advance!

Phil

1. https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPJavaInstall
and https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig
and https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSpoofChecking

2. https://github.com/IQSS/dataverse/issues/2180#issuecomment-116801203

3. https://github.com/IQSS/dataverse/commit/b64623c

-- 
Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin