DuoOIDC HTTP Proxy

[Sean Mason]

So, I've currently configured the following in conf/authn/duo-oidc-authn-config.xml:
<bean id="shibboleth.authn.DuoOIDC.NonBrowser.HttpClient"
  parent="shibboleth.HttpClientFactory"
  p:connectionProxyHost="[some uwaterloo proxy]"
  p:connectionProxyPort="3128" />

With 'DEBUG' logging enabled on org.apache.http I see the following when DuoOIDC attempts the health check:
DEBUG [org.apache.http.impl.conn.PoolingHttpClientConnectionManager:267] - Connection request: [route: {s}->https://[uwaterloo-host].duosecurity.com:443][total available: 0; route allocated: 0 of 100; total allocated: 0 of 100]

To compare to see what a successful connection through the proxy looks like, I've also captured the IdP's request for CAF metadata, which is being requested through the proxy successfully, I see:

DEBUG [org.apache.http.impl.conn.PoolingHttpClientConnectionManager:267] - Connection request: [route: {tls}->http://[some uwaterloo proxy]:3128->https://caf-shib2ops.ca:443][total available: 0; route allocated: 0 of 2; total allocated: 0 of 20]

It appears as though the request isn't being sent through the proxy.

I've run a tcpdump on port 3128, and see mess of output when the metadata is being fetched, and nothing when the IdP attempts to call that health check.  

I've wondered if conf/authn/duo-oidc-authn-config.xml is being consumed, so I broke the config with a syntax error, and the IdP throws parse errors when DuoOIDC is called in the MFA flow, so it's definitely being consumed.

I'm not sure where to go from here?
Thank you for your help so far,
Sean.

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Wednesday, May 19, 2021 9:34 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: DuoOIDC HTTP Proxy

On 5/19/21, 9:29 AM, "users on behalf of Sean Mason" <users-bounces at shibboleth.net on behalf of sean.mason at uwaterloo.ca> wrote:

>    Is there some logging I can enable to get insight into what settings the HttpClient is using at run time?

org.apache.http

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net