Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5

[Koeritz, Chris (cak0l)]

Hi Scott,
I tried switching from the “X-Remote-User” header to “Sec-Fetch-Mode” in the RemoteUser area of the authn.properties file.  That header is also present in the tcpdump output.  I still got:
2024-07-22 16:38:38,652 - 172.18.8.29 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:277] - e1s3: User identity not found in request
I tried with two other headers that should definitely be present (according to the tcpdump), “Priority” and “Connection”, and got the same result.
These obviously would have the wrong user ID value if they worked, but they all seemed to fail in the same way as X-Remote-User, for whatever reason.

Our startup time does seem slow, but includes the IdP startup.  We have about 650 Service Providers’ metadata and about 320 attribute filter definitions.  I’m not sure if that explains the additional startup time, or if our VM is just underpowered compared to the host you’re running on.  This startup delay seems consistent with our production Shib IdP v4 systems also.
Thanks,
Chris

--
Chris Koeritz
Senior Linux and Storage Engineer
University of Virginia ITS - Backup, Storage, and Archive Services
P: 434 982 4690



From: Cantor, Scott <cantor.2 at osu.edu>
Date: Monday, July 22, 2024 at 4:22 PM
To: Shib Users <users at shibboleth.net>
Cc: Koeritz, Chris (cak0l) <cak0l at virginia.edu>
Subject: Re: Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5
My advice, assuming you have a suitable dev environment, is to point it at an obviously ridiculous but known to be "present" header, and see if it pulls that in properly.

No reason it shouldn't work, but I wonder if the "X-" syntax is causing an issue.

We don't log headers.

> With the normal “INFO” level logging, Jetty starts up within
> 39 seconds on our development host.

Mine takes like 5 seconds. The rest is the IdP getting going, and even that only takes maybe 10 more. That doesn't sound right to me.

-- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240722/b3c1f33a/attachment.htm>