Resolved: passing headers and attributes with AJP

[Woolf, Carl]

Hi Peter,

Oh, I think someone has already updated the Wiki – it now mentions allowedRequestAttributesPattern.

The community / committers are a very responsive, helpful bunch!

Thanks, -Carl

From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Date: Wednesday, August 3, 2022 at 5:34 PM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Resolved: passing headers and attributes with AJP
* Woolf, Carl <Carl_Woolf at hms.harvard.edu> [2022-08-03 16:40]:
> ProxyPass "/our-app/" "ajp://shrine-sso-node01.catalyst.harvard.edu:8009/our-app/"

Note that there's no transport-layer security here so this would
depend (1) on a secure network (from your web server to that other
host) and (2) configuration on system running the Tomat AJP connector
to make sure noone/nothing else can connect to that port other than
the webserver running Shib.
In most cases the AJP connection happens to localhost which doesn't
need (or benefit from) further securing, so these requirements may or
may not have been discussed earlier when you brought his up here.

* Woolf, Carl <Carl_Woolf at hms.harvard.edu> [2022-08-03 22:01]:
> And then, per https://stackoverflow.com/questions/63505670/apache-cant-connect-to-new-tomcat-9-ajp
>
> I added allowedRequestAttributesPattern=".*" in the ajp connector in server.xml.

Yeah, or a more restrictive version of that (where easily possible).

I got bitten by allowedRequestAttributesPattern myself when I hadn't
worked with Tomcat for a while and the code enforcing this (i.e.,
prevents attributes from being accepted unless allowlisted that way)
appeared in the (OS-packaged) Tomcat version I was using but the
documentation mentioning that requirement didn't. ;)

> Seems like both were essential. Now I am getting attributes, and have turned off headers!

Yes, both are, these days.
If the Shib wiki doesn't mention Tomcat now needing
allowedRequestAttributesPattern this should be added, of course.
Feel free to do that yourself (or someone else will hopefully get to
it, myself not excluded).
-peter
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220804/a8d9e073/attachment.htm>