Documentation on 'e' and 's' in execution=eXsY

[Chris Reeves]

Hi both,

The first thing that I would do is check what cookies are being set. Most
problems that I've seen where headers have been to large have been down to
cookies. While headers like User-Agent are user-controlled, your average user
isn't going to touch these, but the Cookie header can grow simply by a user
interacting with a lot of services in the same cookie domain.

As an example, we have a lot of services that are hosted under www.york.ac.uk,
and the various proxy servers set cookies for session affinity. We very
occasionally come across users who have interacted with too many of these, the
Cookie header grows to large, and then we see these sorts of errors.

Regards,
    Chris

On Thu 02 Feb 2023 at 18:49:00 +0000, Jeff Chapin via users wrote:
> It's very similar -- but we don't seem to have the  AH03229:
> ajp_msg_append_cvt_string(): BufferOverflowException portion. It looks like
> we have the rest.
> 
> On Thu, Feb 2, 2023 at 12:07 PM Morgan, Andrew J <morgan at oregonstate.edu>
> wrote:
> 
> > I see an AJP error in my Apache logs several times a day as well.  Here is
> > an example from yesterday:
> >
> > [Wed Feb 01 17:08:29.923773 2023] [proxy_ajp:error] [pid 31685] AH03229:
> > ajp_msg_append_cvt_string(): BufferOverflowException 4 770
> > [Wed Feb 01 17:08:29.923979 2023] [proxy_ajp:error] [pid 31685] [client
> > 10.214.152.45:62219] AH00971: ajp_marshal_into_msgb: Error appending the
> > header value, referer: https://jobs.oregonstate.edu/
> > [Wed Feb 01 17:08:29.924038 2023] [proxy_ajp:error] [pid 31685] [client
> > 10.214.152.45:62219] AH00988: ajp_send_header: ajp_marshal_into_msgb
> > failed, referer: https://jobs.oregonstate.edu/
> > [Wed Feb 01 17:08:29.924073 2023] [proxy_ajp:error] [pid 31685]
> > (120001)APR does not understand this error code: [client
> > 10.214.152.45:62219] AH00868: request failed to [::1]:8009 (localhost),
> > referer: https://jobs.oregonstate.edu/
> >
> > From the Apache and IDP logs, this doesn't appear to be a loop.  I don't
> > know why the header would be too big, either.
> >
> > We're running this on Debian 10 with their latest apache2 and tomcat9
> > packages.
> >
> > Is this the same error that you are seeing Jeff?
> >
> > Thanks,
> > Andy
> >
> > ------------------------------
> > *From:* users <users-bounces at shibboleth.net> on behalf of Cantor, Scott
> > via users <users at shibboleth.net>
> > *Sent:* Thursday, February 2, 2023 7:27 AM
> > *To:* Jeff Chapin <jeff.chapin at uni.edu>
> > *Cc:* Cantor, Scott <cantor.2 at osu.edu>; Shib Users <users at shibboleth.net>
> > *Subject:* Re: Documentation on 'e' and 's' in execution=eXsY
> >
> > [This email originated from outside of OSU. Use caution with links and
> > attachments.]
> >
> > > We have seen similar errors in the past when one of our SPs was trying to
> > > append a *VERY* long header, which was longer than the default header
> > length,
> > > so I may have jumped to a false conclusion.
> >
> > My point is the SP might contaminate its own headers with cookies or what
> > have you, but it can't make the requests to the IdP "bigger" apart from via
> > the request URL or body. It can't "add headers" to the IdP requests.
> >
> > As for the IdP, I am not aware of any scenario with loops that changes
> > much about the size of the requests. Cookies get replaced perhaps, but not
> > added.
> >
> > Even a full login loop in local storage if it happened would replace the
> > SP record with the new one, the cache doesn't track > 1 session per SP.
> >
> > -- Scott
> >
> >
> >
> > --
> > For Consortium Member technical support, see
> > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C9b6e113a54f7486cd60108db0531fbd7%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638109484452455009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ea%2FV7cpPpViBUJiSYIxVp%2B80ZTyxg9R0lEE7%2FZA%2FRqg%3D&reserved=0
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> >
> 
> 
> -- 
> 
> Jeff Chapin,
> 
> Panther eSports Adviser
> Systems/Applications Administrator
> ITS-IS, University of Northern Iowa
> Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu

> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net