Future of AJP might be OK?

[Herron, Joel D]

Before moving to jetty we moved off AJP to HTTPS (Apache 2.4 -> Tomcat 9) back in the 3.4.x days had no issues.

From: users <users-bounces at shibboleth.net> on behalf of Richard Frovarp via users <users at shibboleth.net>
Date: Friday, July 15, 2022 at 10:05 PM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Richard Frovarp <richard.frovarp at ndsu.edu>
Subject: Re: Future of AJP might be OK?
EXTERNAL EMAIL
Long term AJP is going away. The Tomcat maintainers have said to move off of mod_jk and then eventually onto HTTP(S) for proxying. Lookup their talk from last year's ApacheCon.

On Fri, 2022-07-15 at 22:38 +0000, Woolf, Carl wrote:
My people now, digging a bit deeper, think that some options for AJP on Apache / Tomcat might remain viable:

https://tomcat.apache.org/tomcat-10.0-doc/config/ajp.html#Connector_Comparison
vs https://tomcat.apache.org/tomcat-10.1-doc/config/ajp.html#Connector_Comparison

Looks like the only connector mentioned explicitly in 10.0 that is dropped in 10.1 is the APR/native Connector.

In 10.1 “"The native connectors supported with this Tomcat release are:
    JK 1.2.x with any of the supported servers. See the JK docs for details.
    mod_proxy on Apache httpd 2.x (included by default in Apache HTTP Server 2.2), with AJP enabled: see the httpd docs for details.”

This could imply that AJP is supported by mod_jk and mod_proxy via the Nio connector classes, though NOT through the Native Connector (deprecated).
I wonder if these supported options would suffice for Shibboleth?

Thanks, - Carl

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220717/4987aad4/attachment.htm>