Shibboleth, Tomcat, AJP and UTF-8 conversion

[Robert Führicht]

> I can't speak to the workaround he used 

https://github.com/fuero/tomcat-encoding-filter

> or whether by now there are others known to him

We had one more application that needed this since I last
looked at this mess, an in-house development.

So I guess a lot of others were just lucky.

My €.02 on this:

AJP 1.3 doesn't [ajp13, ajp13a] specify which encoding its strings
should be in, so it 
relies on HTTP. It does just pass the string values the web server
handed it.

The RFC [rfc7230] covering this isn't conclusive:

> Historically, HTTP has allowed field content with text in the
ISO-8859-1 
> charset [ISO-8859-1], supporting other charsets only through use of
[RFC2047]
> encoding. In practice, most HTTP header field values use only a
subset of the 
> US-ASCII charset [USASCII]. Newly defined header fields SHOULD limit
their field 
> values to US-ASCII octets. A recipient SHOULD treat other octets in
field content 
> (obs-text) as opaque data.

Sadly, as the RFC doesn't lock it down, the encoding depends on the
implementation used.
So to be safe, you have assume the worst - which is ISO-8859-1 (at
least according to the
Tomcat people).

Find the code for the filter I hacked together here:

[rfc7230]: https://tools.ietf.org/html/rfc7230#section-3.2.4 "RFC 7230
- HTTP/1.1 Message Syntax and Routing, Section 3.2.4"
[ajp13]: http://tomcat.apache.org/tomcat-3.3-doc/AJPv13.html "AJP 1.3"
[ajp13a]: http://tomcat.apache.org/connectors-doc/ajp/ajpv13a.html
"Tomcat docs - AJP 1.3"
 
>>> Mark Juszczec <mark.juszczec at gmail.com> 2016-10-20 19:19 >>> 
On Thu, Oct 20, 2016 at 1:13 PM, Peter Schober
<peter.schober at univie.ac.at>
wrote:

>
>
> I now recall a collegue (also being on this list) having had the
same
> issue, which he documented here:
> http://fuero.github.io/shibboleth-tomcat-charset-oddities/

>
>
Thanks for the link.  I've read it and will definitely get in touch if
he
doesn't respond here.


> > Can you explain "shibbolizing Confluence" ?
>
> Unrelated, sorry. "Confluence" is a somewhat popular "enterprise
CMS"
> by Atlassian Pty Ltd written in Java, that (in this community) is
> often integrated with SAML-based SSO infrastructure using the
> Shibboleth Service Provider software, a process we sometimes call
> "shibbolizing" software.
>

That's what I thought you meant, but I wanted to make sure I wasn't
overlooking something that might help solve this problem.