testbed configuration

[Kevin Buckley]

Hi there

I have been trying to re-familiarise myself with the Shibboleth
eco-system, initially by setting up an IdP+SP pair on a couple
of machine-local VMs, making use of RFC 1918 range IPs with the
server names in the 168.192.in-addr.arpa domain so as to make
it feel less "artificial".

As a reult of following my nose to

     https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631502/Installation

and

     https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/2936012848/Jetty10

but also taking on board some other advice, I have so far deployed,
to host the IdP

OS:    Rocky 8 OS
JDK:   java-11-openjdk
Jetty: 10

and have deployed the Shib v4 IdP WAR from the

     shibboleth-identity-provider-4.3.1

tarball into the Jetty. to the extent that I can see it,
in the Jetty "known contexts" list.

I also have a front-end Apache server, listenting on 443, that
proxies into the Jetty instance.

Trying to access my SP's "secure" area, at

    https://rocky8-02.168.192.in-addr.arpa/secure

sees an Internal Server Error from the IdP at

   https://idp.168.192.in-addr.arpa/idp/profile/SAML2/Redirect/SSO?SAMLRequest=jZ...tomanychars...

so at least the SP knows which IdP to go to, whilst a bit more deeper
digging on the IdP shows that the following is going on when I try
to access it's "admin/hello" endpoint directly:

[ssl:debug]        [pid 14908:tid 14] ssl_engine_kernel.c(422): [client 192.168.56.1:41458] AH02034: Initial (No.1) HTTPS request received for child 0 (server idp.168.192.in-addr.arpa:443)
[authz_core:debug] [pid 14908:tid 14] mod_authz_core.c(846):    [client 192.168.56.1:41458] AH01628: authorization result: granted (no directives)
[proxy:debug]      [pid 14908:tid 14] mod_proxy.c(1265):        [client 192.168.56.1:41458] AH01143: Running scheme ajp handler (attempt 0)
[proxy_ajp:debug]  [pid 14908:tid 14] mod_proxy_ajp.c(769):     [client 192.168.56.1:41458] AH00895: serving URL ajp://localhost:8080/idp/profile/admin/hello
[proxy:debug]      [pid 14908:tid 14] proxy_util.c(2353):                                   AH00942: AJP: has acquired connection for (localhost)
[proxy:debug]      [pid 14908:tid 14] proxy_util.c(2408):       [client 192.168.56.1:41458] AH00944: connecting ajp://localhost:8080/idp/profile/admin/hello to localhost:8080
[proxy:debug]      [pid 14908:tid 14] proxy_util.c(2634):       [client 192.168.56.1:41458] AH00947: connected /idp/profile/admin/hello to localhost:8080
[proxy:debug]      [pid 14908:tid 14] proxy_util.c(3104):                                   AH02824: AJP: connection established with [::1]:8080 (localhost)
[proxy_ajp:debug]  [pid 14908:tid 14] mod_proxy_ajp.c(294):     [client 192.168.56.1:41458] AH00872: APR_BUCKET_IS_EOS
[proxy_ajp:debug]  [pid 14908:tid 14] mod_proxy_ajp.c(300):     [client 192.168.56.1:41458] AH00873: data to read (max 8186 at 4)
[proxy_ajp:debug]  [pid 14908:tid 14] mod_proxy_ajp.c(314):     [client 192.168.56.1:41458] AH00875: got 0 bytes of data
[proxy_ajp:error]  [pid 14908:tid 14]                           [client 192.168.56.1:41458] AH00992: ajp_read_header: ajp_ilink_receive failed
[proxy_ajp:error]  [pid 14908:tid 14] (120007)APR does not understand this error code: [client 192.168.56.1:41458] AH00878: read response failed from [::1]:8080 (localhost)
[proxy:debug]      [pid 14908:tid 14] proxy_util.c(2368):                                   AH00943: AJP: has released connection for (localhost)
[ssl:debug]        [pid 14908:tid 14] ssl_engine_io.c(1112):    [client 192.168.56.1:41458] AH02001: Connection closed to child 0 with standard shutdown (server idp.168.192.in-addr.arpa:443)


Suffice it to say that I don't understand the

   "APR does not understand this error code"

bit and so wanted to ask,

   is this a known "people new, or returning anew, to Shibboleth
    after a longish time away" gotcha, or something else altogether?

Either way, any clues/pointers to getting this testbed setup?

Kevin Buckley