[EXTERNAL] Re: SP server variables an IIS with Tomcat Connector

[Bobby Lawrence]

This was a good idea, but unfortunately it didn't help.  I set allowedRequestAttributesPattern=".*" in the Coldfusion runtime's server.xml but I still have no SP request attributes being sent.
And yes - the AJP protocol.  I said "Tomcat connector" because that's what the software is called that provides the AJP protocol "link" between IIS and/or Apache HTTP and Tomcat.


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober via users
Sent: Saturday, February 24, 2024 9:13 AM
To: users at shibboleth.net
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: [EXTERNAL] Re: SP server variables an IIS with Tomcat Connector

Bobby Lawrence via users <users at shibboleth.net> [2024-02-23 21:23 CET]:
> I cannot determine if this issue is a ColdFusion proper issue or the 
> Tomcat Connector for IIS that CF uses.  I decompiled the 
> coldfusion.runtime.CgiScope class I can see where it would try to 
> resolve the value for some name from request.getAttribute(), but again 
> - I always get no value, even when the SP is protecting the page.  
> This leads me to believe that it's a Tomcat Connector issue (which is 
> an ISAPI filter - not a module :().  I've read on some other forums 
> that in order to access certain CGI variables in CF fronted by Apache 
> that you need to declare them in mod_jk.conf via the "JkEnvVar" 
> directive.  It doesn't look like the IIS connector has any such option 
> so I cannot try it.

Now I know nothing about ColdFusion (or IIS, for that matter) but maybe parts from this https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_spaces_SP3_pages_2067400159_JavaHowTo&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=inEDN2sRGzORLtcwpkVEYEzhSRZbgBFmc3FrNa0K_DMVgo35mk119M-e_IViV1oA&s=aV3OuFhd0L75HHaSPDJJ7sJHL_XiC6TUo4yVkkj7j_0&e=
may be relevant here, too?

At least I'm assuming use of the AJP protocol in your deployment (what else could a "Tomcat Connector" be?) and with Tomcat on the receiving end the "allowedRequestAttributesPattern" attribute on the AJP Connector in Tomcat[1] may well be responsible for the data not being accepted.

-peter

[1] https://urldefense.proofpoint.com/v2/url?u=https-3A__tomcat.apache.org_tomcat-2D10.1-2Ddoc_config_ajp.html&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=inEDN2sRGzORLtcwpkVEYEzhSRZbgBFmc3FrNa0K_DMVgo35mk119M-e_IViV1oA&s=duxJ_usaC9Y43om0gnlcs5kFLX8aNNzWpEkaA5FZu2Y&e=
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=inEDN2sRGzORLtcwpkVEYEzhSRZbgBFmc3FrNa0K_DMVgo35mk119M-e_IViV1oA&s=nDgW1k_qqouXBkL3o8ptK5y8V2s6luKT0uwUP-t5-to&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net