HTTPConnector with proxy
Manolo Garcia Alvarez
mgarciaal at uoc.edu
Thu May 13 06:19:08 UTC 2021
Thanks Scott. However, we are still stuck on this...
As I explained in the first message, we have configured in our
attribute-resolver a HTTP DataConnector to recover info from an external
webservice, and the only way to access it is through a proxy. So far we've
tried some options:
1. Establish proxy properties on the Operating System -> the IDP omits
them
2. Establish proxy properties on the Application server (Tomcat) -> the
IDP omits them
3. Establish proxy properties on the IDP (idp.properties) -> the IDP
omits them
So far so good, because the documentation (
https://wiki.shibboleth.net/confluence/display/IDP30/HttpClientConfiguration )
already specifies "some of the components that require or at least support
the injection of a custom client bean include: .... a forthcoming
HTTPDataConnector for web service access in the attribute resolver"
So following your guidance, we modified our services.xml to define some of
the beans:
<bean id="httpClientBuilder"
class="net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder">
<property name="connectionProxyHost" value="
proxy-test.example.org"/>
<property name="connectionProxyPort" value="3128"/>
</bean>
<bean id="proxyHttpClient" factory-bean="httpClientBuilder"
factory-method="buildClient"/>
<bean id="CustomHttpSecurity"
class="org.opensaml.security.httpclient.HttpClientSecurityParameters">
<property name="basicCredentials">
<bean
class="org.apache.http.auth.UsernamePasswordCredentials"
c:_0="%{idp.httpclient.resolver.credentials.user}"
c:_1="%{idp.httpclient.resolver.credentials.password}" />
</property>
</bean>
<bean id="customCondition"
parent="shibboleth.Conditions.RelyingPartyId">
<constructor-arg name="candidates">
<list>
<value>urn:amazon:webservices</value>
<value>arn:aws:iam::579899986493:saml-provider/TESTLABS</value>
<value>arn:aws:iam::014990139462:saml-provider/TESTLABS</value>
</list>
</constructor-arg>
</bean>
On the bean "httpClientBuilder" we set the proxy properties, and on the
bean "proxyHttpClient" we build it. This "proxyHttpClient" is used on the
attribute-resolver.xml:
<DataConnector id="apiGW" xsi:type="HTTP"
httpClientRef="proxyHttpClient"
httpClientSecurityParametersRef="CustomHttpSecurity"
activationConditionRef="customCondition"
validatorRef="shibboleth.NonFailFastValidator"
acceptStatuses="200 404 400 500 503"
>
What we have seen is that Shibboleth IDP seems to omit the configuration of
the bean declared on "httpClientRef", but other beans as
"activationConditionRef" and "httpClientSecurityParametersRef" are
correctly retrieved.
On the IDP logs we can see, that the attribute-resolver detects that needs
to use apiGW (so activationConditionRef OK), but the request is sent
directly to the webservice (https://informacio-test.example.org) and not
the proxy (proxy-test.example.org)
2021-05-12 14:34:13,987 - TRACE
[net.shibboleth.idp.attribute.resolver.dc.impl.AbstractSearchDataConnector:184]
- Data Connector 'apiGW': Cache found, resolved attributes null using cache
com.google.common.cache.LocalCache$LocalManualCache at 32089fe9<mailto:
com.google.common.cache.LocalCache$LocalManualCache at 32089fe9>
2021-05-12 14:34:13,987 - DEBUG
[org.apache.http.client.protocol.RequestAddCookies:123] - CookieSpec
selected: default
2021-05-12 14:34:13,988 - DEBUG
[org.apache.http.client.protocol.RequestAuthCache:77] - Auth cache not set
in the context
2021-05-12 14:34:13,988 - DEBUG
[org.apache.http.impl.conn.PoolingHttpClientConnectionManager:255] -
Connection request: [route: {s}->https://informacio-test.example.org:443][total
kept alive: 0; route allocated: 0 of 100; total allocated: 0 of 100]
2021-05-12 14:34:13,989 - DEBUG
[org.apache.http.impl.conn.PoolingHttpClientConnectionManager:288] -
Connection leased: [id: 3][route: {s}->https://informacio-test
.example.org:443][total kept alive: 0; route allocated: 1 of 100; total
allocated: 1 of 100]
2021-05-12 14:34:13,989 - DEBUG
[org.apache.http.impl.execchain.MainClientExec:235] - Opening connection
{s}->https://informacio-test.example.org:443
<https://informacio-test.example.org/>
2021-05-12 14:34:14,036 - DEBUG
[org.apache.http.impl.conn.DefaultHttpClientConnectionOperator:139] -
Connecting to informacio-test.example.org/123.456.789.000:443
After two minutes, the Data Connector fails because we cannot exit directly
to Internet:
2021-05-12 14:36:14,105 - ERROR
[net.shibboleth.idp.profile.impl.ResolveAttributes:314] - Profile Action
ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector
'apiGW': HTTP request failed at
net.shibboleth.idp.attribute.resolver.dc.http.impl.HTTPDataConnector.retrieveAttributes(HTTPDataConnector.java:109)
Caused by: org.apache.http.conn.ConnectTimeoutException: Connect to
informacio-test.example.org:443 [informacio-test.example.org/223.456.789.000
, informacio-test.example.org/123.456.789.000] failed: connect timed out
at
org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151)
Caused by: java.net.SocketTimeoutException: connect timed out at
java.net.PlainSocketImpl.socketConnect(Native Method)
Has anybody succeeded with this? Maybe an example of a bean definition, for
an HttpClient with proxy to be used on the Attribute Resolver? Any help
would be appretiated.
Thanks a lot
El mié, 5 may 2021 a las 17:36, Cantor, Scott (<cantor.2 at osu.edu>) escribió:
> On 5/5/21, 11:10 AM, "users on behalf of Manolo Garcia Alvarez" <
> users-bounces at shibboleth.net on behalf of mgarciaal at uoc.edu> wrote:
>
> > The HTTPConnector works just fine when there is direct access to the
> service, but when we use an HTTP proxy
> > (adding https.proxyHost and https.proxyPort in the Tomcat bootstrap),
> the HTTPConnector seems to ignore it.
>
> I certainly hope so.
>
> > Has anybody successfully used the HTTPConnector with a proxy? Is
> there any additional configuration for the
> > HTTPConnector?
>
> Most of the HTTP client settings are in the javadocs [1] for the builder
> base class the HttpClient factory bean is based on.
>
> -- Scott
>
> [1]
> https://build.shibboleth.net/nexus/content/sites/site/java-support/8.2.0/apidocs/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.html?is-external=true
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
--
------------------------------
Manolo García
Arquitectura i Sistemes
Universitat Oberta de Catalunya
689 88 30 93 | mgarciaal at uoc.edu
Parc Mediterrani de la Tecnologia (edifici B3)
Av. Carl Friedrich Gauss, 5.
08860 Castelldefels
[image: Universitat Oberta de Catalunya]
--
INFORMACIÓ SOBRE PROTECCIÓ DE DADES DE LA UNIVERSITAT OBERTA DE
CATALUNYA (UOC)
Us informem que les vostres dades identificatives i les
contingudes en els missatges electrònics i fitxers adjunts es poden
incorporar a les nostres bases de dades amb la finalitat de gestionar les
relacions i comunicacions vinculades a la UOC, i que es poden conservar
mentre es mantingui la relació. Si ho voleu, podeu exercir el dret a
accedir a les vostres dades, rectificar-les i suprimir-les i altres drets
reconeguts normativament adreçant-vos a l'adreça de correu emissora o a
fuoc_pd at uoc.edu <mailto:fuoc_pd at uoc.edu>.
Aquest missatge i qualsevol
fitxer que porti adjunt, si escau, tenen el caràcter de confidencials i
s'adrecen únicament a la persona o entitat a qui s'han enviat.
Així
mateix, posem a la vostra disposició un delegat de protecció de dades que
no només s'encarregarà de supervisar tots els tractaments de dades de la
nostra entitat, sinó que us podrà atendre per a qualsevol qüestió
relacionada amb el tractament de dades. La seva adreça de contacte és
dpd at uoc.edu <mailto:dpd at uoc.edu>.
INFORMACIÓN SOBRE PROTECCIÓN DE DATOS DE
LA UNIVERSITAT OBERTA DE CATALUNYA (UOC)
Os informamos de que vuestros
datos identificativos y los contenidos en los mensajes electrónicos y
ficheros adjuntos pueden incorporarse a nuestras bases de datos con el fin
de gestionar las relaciones y comunicaciones vinculadas a la UOC, y de que
pueden conservarse mientras se mantenga la relación. Si lo deseáis, podéis
ejercer el derecho a acceder a vuestros datos, rectificarlos y suprimirlos
y otros derechos reconocidos normativamente dirigiéndoos a la dirección de
correo emisora o a fuoc_pd at uoc.edu <mailto:fuoc_pd at uoc.edu>.
Este mensaje y
cualquier fichero que lleve adjunto, si procede, tienen el carácter de
confidenciales y se dirigen únicamente a la persona o entidad a quien se
han enviado.
Así mismo, ponemos a vuestra disposición a un delegado de
protección de datos que no solo se encargará de supervisar todos los
tratamientos de datos de nuestra entidad, sino que podrá atenderos para
cualquier cuestión relacionada con el tratamiento de datos. Su dirección de
contacto es dpd at uoc.edu <mailto:dpd at uoc.edu>.
UNIVERSITAT OBERTA DE
CATALUNYA (UOC) DATA PROTECTION INFORMATION
Your personal data and the data
contained in your email messages and attached files may be stored in our
databases for the purpose of maintaining relations and communications
linked to the UOC, and the data may be stored for as long as these
relations and communications are maintained. If you so wish, you can
exercise your rights to access, rectification and erasure of your data, and
any other legally held rights, by writing to the sender’s email address or
to fuoc_pd at uoc.edu <http://fuoc_pd@uoc.edu>.
This message and, where
applicable, any attachments are confidential and addressed solely to the
individual or organization they were sent to.
The UOC has a data protection
officer who not only supervises the data processing carried out at the
University, but who will also respond to any questions you may have about
this data processing. You can contact our data protection officer by
writing to dpd at uoc.edu <http://dpd@uoc.edu>.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210513/947ec700/attachment.htm>
More information about the users
mailing list