Shibboleth, Tomcat, AJP and UTF-8 conversion

[Mark Juszczec]

I'm using Shibboleth to authenticate via SAML.

Shibboleth sends some assertions, via Apache, to my app running behind
Tomcat 8.

Tomcat is configured to use AJP 1.3 for communication.

The problem is the UTF-8 data is corrupted once it comes off the AJP port.

I have debugged into the Tomcat AJP classes and see the bytes are correct.
They arrive in an object called ByteChunk and are then converted to a
String and the charset is ISO-8859-1.

The String is incorrect.

ISO-8859-1 is the default used by ByteChunk and I've verified it is not
reset/changed to UTF-8 despite having specified it in server.xml per Tomcat
documentation.

I found this:

https://issues.shibboleth.net/jira/browse/SSPCPP-2

which says this problem has been around since at least 2007

Then I found this:

https://wiki.shibboleth.net/confluence/plugins/servlet/mobile#content/view/4358180

which suggests the following solution:

String value= request.getHeader("givenName");
value= new String( value.getBytes("ISO-8859-1"), "UTF-8");

I have to get my data via request.getAttribute("key")

Is the solution appropriate for data delivered as attributes?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161019/1e5076e2/attachment-0001.html>