Solved - Re: Latest Jetty 9.4.32 breaks our IdP

[brabec at ncsu.edu]

Takeshi,

Thanks for the tip. I don't think that was my issue since I'm not
running Jetty behind a proxy, it does the SSL termination itself. 

However, while looking through my jetty config files for a similar
setting as you suggested, I noticed that I've been carrying forward an
old copy of etc/jetty.xml that was missing some of the latest pieces.
When I remove that file and let it use the distribution copy, it started
working correctly again.

Thank you,
Charles

On Oct 13, Takeshi Nishimura (takeshi at nii.ac.jp) was heard to say:
> Hi Charles,
> 
> Add
>     RequestHeader set X-Forwarded-Port 443
> 
> Best regards,
> Takeshi
> 
> > 2020/10/13 0:40、brabec at ncsu.edu wrote:
> > 
> > I run our IdP in a docker container, built from:
> > - CentOS 7
> > - Amazon Coretto 11.0.8.10.1
> > - Jetty 9.4.x
> > - Shibboleth IdP 4.0.1
> > 
> > I run monthly updates and they usually go smoothly. This month, trying
> > to use the newest Jetty has introduced an error.
> > 
> > Fresh build with Jetty 9.4.31, works fine.
> > Fresh build with Jetty 9.4.32, upon receipt of a SAML auth request
> > message this error is thrown:
> > 
> > ERROR [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:198] - 
> > Message Handler:  SAML message intended destination endpoint 
> > 'https://shib.ncsu.edu/idp/profile/SAML2/Redirect/SSO' 
> > did not match the recipient endpoint 
> > 'https://shib.ncsu.edu:80/idp/profile/SAML2/Redirect/SSO'
> > 
> > It looks like Jetty is passing the port ':80' as part of the hostname
> > now, where it wasn't before.
> > 
> > Has anyone else run into this? Is there a variable I can set somewhere
> > to override this?
> > 
> > Thanks,
> > Charles
> > 
> > -- 
> > Charles J. Brabec - brabec at ncsu.edu       
> > Web Systems Architect - Identity/Web Services 
> > 
> > All electronic mail messages in connection with State business which are
> > sent to or received by this account are subject to the NC Public Records Law
> > and may be disclosed to third parties.
> 
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Charles J. Brabec - brabec at ncsu.edu       
Web Systems Architect - Identity/Web Services 

All electronic mail messages in connection with State business which are
sent to or received by this account are subject to the NC Public Records Law
and may be disclosed to third parties.