AW: IDP3.2.1 Unable to decode incoming request

[Käfer Thomas]

Dear Scott,


thanks for your reply. I'm sorry, I should have explained my situation better. What I was hoping for by writing to this list was a way to narrow down the cause of my problem. Some hints how to debug this problem and find it's cause.



About the need to tune the config files of jetty 9.3.10 to get the IDP to work as well as it did with 9.3.6, here's a list of what I did:


-) add the java startup parameter "-Djava.security.egd=file:/dev/./urandom" to line 353 of jetty.sh to get rid of startup delay


-) copy the keystore file to jetty/etc/keystore and save it's passwords into the appropriate places of jetty-ssl-context.xml


-) add list of excluded CipherSuites to jetty-ssl-context.xml to make firefox accept the https connection:

  <Set name="ExcludeCipherSuites">
   <Array type="String">
    <Item>SSL_RSA_WITH_DES_CBC_SHA</Item>
    <Item>SSL_DHE_RSA_WITH_DES_CBC_SHA</Item>
    <Item>SSL_DHE_DSS_WITH_DES_CBC_SHA</Item>
    <Item>SSL_RSA_EXPORT_WITH_RC4_40_MD5</Item>
    <Item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
    <Item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
    <Item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</Item>
   </Array>
  </Set>

-) add rule to get our favicon to be used to jetty-rewrite.xml

      <Call name="addRule">
        <Arg>
          <New class="org.eclipse.jetty.rewrite.handler.RewritePatternRule">
            <Set name="pattern">/favicon.ico</Set>
            <Set name="replacement">/idp/favicon.ico</Set>
          </New>
        </Arg>
      </Call>

-) add rule to prevent browsers to ask for http version (which reduces risk of man-in-the-middle attacks) to jetty-rewrite.xml
<Call name="addRule">
    <Arg>
<New class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule">
    <Set name="pattern">*</Set>
    <Set name="name">Strict-Transport-Security</Set>
    <Set name="value">max-age=31536000; includeSubDomains</Set>
</New>
    </Arg>
</Call>

-) copy block from https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration into jetty.xml to allow JAAS to function:
    <Call name="addBean">
      <Arg>
        <New class="org.eclipse.jetty.jaas.JAASLoginService">
          <Set name="name">ShibUserPassAuth</Set>
          <Set name="LoginModuleName">ShibUserPassAuth</Set>
        </New>
      </Arg>
    </Call>


-) copy start.d directory with https, jaas, rewrite and ssl ini files from old jetty installation


-) copy idp.xml into the new webapps directory



Thanks for your help,

kind regards,

Thomas Käfer

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160718/0b3dd2a1/attachment.html>