Latest Jetty 9.4.32 breaks our IdP

[Takeshi Nishimura]

Hi Charles,

Add
    RequestHeader set X-Forwarded-Port 443

Best regards,
Takeshi

> 2020/10/13 0:40、brabec at ncsu.edu wrote:
> 
> I run our IdP in a docker container, built from:
> - CentOS 7
> - Amazon Coretto 11.0.8.10.1
> - Jetty 9.4.x
> - Shibboleth IdP 4.0.1
> 
> I run monthly updates and they usually go smoothly. This month, trying
> to use the newest Jetty has introduced an error.
> 
> Fresh build with Jetty 9.4.31, works fine.
> Fresh build with Jetty 9.4.32, upon receipt of a SAML auth request
> message this error is thrown:
> 
> ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:198] - 
> Message Handler:  SAML message intended destination endpoint 
> 'https://shib.ncsu.edu/idp/profile/SAML2/Redirect/SSO' 
> did not match the recipient endpoint 
> 'https://shib.ncsu.edu:80/idp/profile/SAML2/Redirect/SSO'
> 
> It looks like Jetty is passing the port ':80' as part of the hostname
> now, where it wasn't before.
> 
> Has anyone else run into this? Is there a variable I can set somewhere
> to override this?
> 
> Thanks,
> Charles
> 
> -- 
> Charles J. Brabec - brabec at ncsu.edu       
> Web Systems Architect - Identity/Web Services 
> 
> All electronic mail messages in connection with State business which are
> sent to or received by this account are subject to the NC Public Records Law
> and may be disclosed to third parties.