Documentation on 'e' and 's' in execution=eXsY

[Jeff Chapin]

It's very similar -- but we don't seem to have the  AH03229:
ajp_msg_append_cvt_string(): BufferOverflowException portion. It looks like
we have the rest.

On Thu, Feb 2, 2023 at 12:07 PM Morgan, Andrew J <morgan at oregonstate.edu>
wrote:

> I see an AJP error in my Apache logs several times a day as well.  Here is
> an example from yesterday:
>
> [Wed Feb 01 17:08:29.923773 2023] [proxy_ajp:error] [pid 31685] AH03229:
> ajp_msg_append_cvt_string(): BufferOverflowException 4 770
> [Wed Feb 01 17:08:29.923979 2023] [proxy_ajp:error] [pid 31685] [client
> 10.214.152.45:62219] AH00971: ajp_marshal_into_msgb: Error appending the
> header value, referer: https://jobs.oregonstate.edu/
> [Wed Feb 01 17:08:29.924038 2023] [proxy_ajp:error] [pid 31685] [client
> 10.214.152.45:62219] AH00988: ajp_send_header: ajp_marshal_into_msgb
> failed, referer: https://jobs.oregonstate.edu/
> [Wed Feb 01 17:08:29.924073 2023] [proxy_ajp:error] [pid 31685]
> (120001)APR does not understand this error code: [client
> 10.214.152.45:62219] AH00868: request failed to [::1]:8009 (localhost),
> referer: https://jobs.oregonstate.edu/
>
> From the Apache and IDP logs, this doesn't appear to be a loop.  I don't
> know why the header would be too big, either.
>
> We're running this on Debian 10 with their latest apache2 and tomcat9
> packages.
>
> Is this the same error that you are seeing Jeff?
>
> Thanks,
> Andy
>
> ------------------------------
> *From:* users <users-bounces at shibboleth.net> on behalf of Cantor, Scott
> via users <users at shibboleth.net>
> *Sent:* Thursday, February 2, 2023 7:27 AM
> *To:* Jeff Chapin <jeff.chapin at uni.edu>
> *Cc:* Cantor, Scott <cantor.2 at osu.edu>; Shib Users <users at shibboleth.net>
> *Subject:* Re: Documentation on 'e' and 's' in execution=eXsY
>
> [This email originated from outside of OSU. Use caution with links and
> attachments.]
>
> > We have seen similar errors in the past when one of our SPs was trying to
> > append a *VERY* long header, which was longer than the default header
> length,
> > so I may have jumped to a false conclusion.
>
> My point is the SP might contaminate its own headers with cookies or what
> have you, but it can't make the requests to the IdP "bigger" apart from via
> the request URL or body. It can't "add headers" to the IdP requests.
>
> As for the IdP, I am not aware of any scenario with loops that changes
> much about the size of the requests. Cookies get replaced perhaps, but not
> added.
>
> Even a full login loop in local storage if it happened would replace the
> SP record with the new one, the cache doesn't track > 1 session per SP.
>
> -- Scott
>
>
>
> --
> For Consortium Member technical support, see
> https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C9b6e113a54f7486cd60108db0531fbd7%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638109484452455009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ea%2FV7cpPpViBUJiSYIxVp%2B80ZTyxg9R0lEE7%2FZA%2FRqg%3D&reserved=0
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230202/1a0f9040/attachment.htm>