[EXTERNAL] Re: SP server variables an IIS with Tomcat Connector

[Bobby Lawrence]

So after some digging, it turns out that this isn't a ColdFusion/Adobe connector issue.
The AJP connector for IIS simply does not pass on request attributes to Tomcat other than a few SSL related ones.  It simply has no mechanism to do this, whereas mod_jk (the Apache variant) does with its JkEnvVar directive.  I've created a bug/feature request for the IIS Tomcat connector in the Apache Bugzilla database.
Looks like I'm stuck with useHeaders=true in the meantime...

-----Original Message-----
From: Bobby Lawrence 
Sent: Monday, February 26, 2024 10:46 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: [EXTERNAL] Re: SP server variables an IIS with Tomcat Connector

Well - I used Wireshark to look at the AJP traffic on port 8122 (this is the port that the ColdFusion Connector Installer sets up) and I don't see anything related to Shibboleth or my attributes going over the wire when "useVariables=true".  When I set "useHeaders=true", I can see them.  
My guess is that the Adobe version of the AJP connector isn't sending them and I'm stuck relying on headers :(

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Bobby Lawrence via users
Sent: Monday, February 26, 2024 9:45 AM
To: Shib Users <users at shibboleth.net>
Cc: Bobby Lawrence <robertl at jlab.org>
Subject: RE: [EXTERNAL] Re: SP server variables an IIS with Tomcat Connector

Yea I set attributePrefix="AJP_" in the ApplicationDefaults element of shibboleth2.xml.
I've turned up the debugging on the connector and watching the logs and I've been trying to look through the connector code on Github but from what I can tell, Adobe has created their own version of the connector which seems to be doing things differently.
I'll look into packet sniffing... 

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober via users
Sent: Monday, February 26, 2024 9:24 AM
To: Shib Users <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: [EXTERNAL] Re: SP server variables an IIS with Tomcat Connector

Bobby Lawrence <robertl at jlab.org> [2024-02-26 15:04 CET]:
> This was a good idea, but unfortunately it didn't help.  I set 
> allowedRequestAttributesPattern=".*" in the Coldfusion runtime's 
> server.xml but I still have no SP request attributes being sent.

OK. Did you try adding attributePrefix="AJP_" as mentioned in step 4 of the JavaHowTo wiki page? (No idea whether that's necessary with the AJP "client" implementation that's part of your software stack.)

Next I'd start sniffing the AJP traffic going to Tomcat to make sure the attributes are actually part of the requests.

-peter
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=5LC3qkfNJMa5mr6q7xOF8S1g02TQdaTaBg13273wtMzXRv3ZDM4AvWQ4hjICYjnI&s=gBJfLY3jin7BkwCjFNTb7c3Kbd-qOBqEa8f5cDAzv3s&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
For Consortium Member technical support, see https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_x_ZYEpPw&d=DwICAg&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=R1W-YDIcNEJoMbvy3D08TxYJkC9TR0gtbhqW0Rv518ci63qb-OD4l0vgTu3An0iY&s=1cFR6evWsOX7-5-FVA32BSq4qhPXCJIthggQtT5OWtI&e=
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net