Latest Jetty 9.4.32 breaks our IdP

brabec at ncsu.edu brabec at ncsu.edu
Mon Oct 12 15:40:53 UTC 2020


I run our IdP in a docker container, built from:
- CentOS 7
- Amazon Coretto 11.0.8.10.1
- Jetty 9.4.x
- Shibboleth IdP 4.0.1

I run monthly updates and they usually go smoothly. This month, trying
to use the newest Jetty has introduced an error.

Fresh build with Jetty 9.4.31, works fine.
Fresh build with Jetty 9.4.32, upon receipt of a SAML auth request
message this error is thrown:

ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:198] - 
Message Handler:  SAML message intended destination endpoint 
'https://shib.ncsu.edu/idp/profile/SAML2/Redirect/SSO' 
did not match the recipient endpoint 
'https://shib.ncsu.edu:80/idp/profile/SAML2/Redirect/SSO'

It looks like Jetty is passing the port ':80' as part of the hostname
now, where it wasn't before.

Has anyone else run into this? Is there a variable I can set somewhere
to override this?

Thanks,
Charles

-- 
Charles J. Brabec - brabec at ncsu.edu       
Web Systems Architect - Identity/Web Services 

All electronic mail messages in connection with State business which are
sent to or received by this account are subject to the NC Public Records Law
and may be disclosed to third parties.


More information about the users mailing list