Documentation on 'e' and 's' in execution=eXsY

[Morgan, Andrew J]

I see an AJP error in my Apache logs several times a day as well.  Here is an example from yesterday:

[Wed Feb 01 17:08:29.923773 2023] [proxy_ajp:error] [pid 31685] AH03229: ajp_msg_append_cvt_string(): BufferOverflowException 4 770
[Wed Feb 01 17:08:29.923979 2023] [proxy_ajp:error] [pid 31685] [client 10.214.152.45:62219] AH00971: ajp_marshal_into_msgb: Error appending the header value, referer: https://jobs.oregonstate.edu/
[Wed Feb 01 17:08:29.924038 2023] [proxy_ajp:error] [pid 31685] [client 10.214.152.45:62219] AH00988: ajp_send_header: ajp_marshal_into_msgb failed, referer: https://jobs.oregonstate.edu/
[Wed Feb 01 17:08:29.924073 2023] [proxy_ajp:error] [pid 31685] (120001)APR does not understand this error code: [client 10.214.152.45:62219] AH00868: request failed to [::1]:8009 (localhost), referer: https://jobs.oregonstate.edu/

>From the Apache and IDP logs, this doesn't appear to be a loop.  I don't know why the header would be too big, either.

We're running this on Debian 10 with their latest apache2 and tomcat9 packages.

Is this the same error that you are seeing Jeff?

Thanks,
Andy

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott via users <users at shibboleth.net>
Sent: Thursday, February 2, 2023 7:27 AM
To: Jeff Chapin <jeff.chapin at uni.edu>
Cc: Cantor, Scott <cantor.2 at osu.edu>; Shib Users <users at shibboleth.net>
Subject: Re: Documentation on 'e' and 's' in execution=eXsY

[This email originated from outside of OSU. Use caution with links and attachments.]

> We have seen similar errors in the past when one of our SPs was trying to
> append a *VERY* long header, which was longer than the default header length,
> so I may have jumped to a false conclusion.

My point is the SP might contaminate its own headers with cookies or what have you, but it can't make the requests to the IdP "bigger" apart from via the request URL or body. It can't "add headers" to the IdP requests.

As for the IdP, I am not aware of any scenario with loops that changes much about the size of the requests. Cookies get replaced perhaps, but not added.

Even a full login loop in local storage if it happened would replace the SP record with the new one, the cache doesn't track > 1 session per SP.

-- Scott



--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C9b6e113a54f7486cd60108db0531fbd7%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638109484452455009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ea%2FV7cpPpViBUJiSYIxVp%2B80ZTyxg9R0lEE7%2FZA%2FRqg%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230202/e736f28c/attachment.htm>