Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5

[Koeritz, Chris (cak0l)]

Hi Scott,
Thanks for testing out Jetty 12.  It’s good to know that things should be working.
I will plan to file a support issue for this, and I believe I’m already on the list that should be able to do that.
However, I added the MDCHeaders bean in global.xml like so:
    <util:map id="shibboleth.MDCHeaders">
      <entry key="idp.headers.x-remote-user" value="X-Remote-User" />
    </util:map>
And I modified the pattern for the idp-process.log to show the header value:
            <Pattern>%date{ISO8601} - %mdc{idp.remote_addr} - %mdc{idp.headers.x-remote-user} - %level [%logger:%line] - %msg%n%ex{short}</Pattern>
The header is blank on every log entry, as expected, except for the middle line below:
====
2024-07-23 10:28:58,983 - 172.18.8.29 -  - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:233] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'UseCert' event to 'authn/RemoteUser' flow
2024-07-23 10:29:01,764 - 172.18.8.29 - cak0l - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:277] - e1s3: User identity not found in request
2024-07-23 10:29:01,791 - 172.18.8.29 -  - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:201] - Profile Action ValidateExternalAuthentication: External authentication failed, no user identity or error information returned
====
The header value is present and correct, but is still not getting processed by the RemoteUser servlet.
Does anything come to mind about why the RemoteUser servlet isn’t scooping that up?
I can still file a support issue, but the fact that the header is showing up with the right value at least means Jetty is not shaving it off.  Perhaps the issue is simpler than it seemed, I hope…
Thanks,
Chris

--
Chris Koeritz
Senior Linux and Storage Engineer
University of Virginia ITS - Backup, Storage, and Archive Services
P: 434 982 4690



From: Cantor, Scott <cantor.2 at osu.edu>
Date: Tuesday, July 23, 2024 at 8:14 AM
To: Shib Users <users at shibboleth.net>
Cc: Koeritz, Chris (cak0l) <cak0l at virginia.edu>
Subject: Re: Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5
Given that you're members, I did run a quick test. At least under Eclipse, Jetty 12 handles a smuggled in X-Remote-User header just fine, the flow worked without any unusual steps. I was expecting to find a regression in the RemoteUser servlet, but I'm not seeing one.

Because you're members, I'm willing to assist, but you'd have to file a support issue (If you don't have access, I can connect you with the person at UV who can add you). I don't offhand know what to suggest at this point though, other than logging some headers to get more insight.

I don't think it's possible that your HTTP traces are accurate, I'm afraid. Something is stripping the header before it reaches the web server, but the logging should prove that.

-- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240723/0269991e/attachment.htm>