[External] Re: Shibboleth Metrics to Splunk

[Jeff Tickle]

On Tue, Mar 12, 2024 at 5:45 AM Peter Schober via users
<users at shibboleth.net> wrote:
>
> Cantor, Scott via users <users at shibboleth.net> [2024-03-11 17:53 CET]:
> > though I'm no fan of "hack in a header for security", that's nothing
> > more than reinventing basic-auth, kind of silly.
>
> If one asked the vendor I'm sure they're convinced they actually *are*
> using HTTP Basic Auth here.

Indeed, I went back to our implementation guy, we worked out that you
can just do a username of "x" with the token in the password, and use
HTTP Basic Auth.

Simple enough, right? Nay, this was but the start of the rabbit hole.
I set up my metrics.xml as indicated in the docs [0]. Then I get this
in the logs anyway:

ERROR [net.shibboleth.idp.metrics.impl.HTTPReporter:269] - Collector
responded with HTTP status 401

Turning the verbosity up to 11, It shows both the outgoing and
incoming headers in the logs, but there is no Authorization header
set, despite the HttpClientSecurityParameters being set. I thought
perhaps the Authorization header was not being logged in order to keep
secrets out of the logs, so I used `openssl s_server` to see what was
really happening. I changed the collectorURL to my own fake server and
gave it my self-signed certificate.

I found that Apache's HttpClient within the IdP does not just throw an
Authorization header at the server. It waits for the server to respond
with 401 Unauthorized, AND for the server to provide the
WWW-Authenticate challenge header. Then, it will re-send the request
with the Authorization header. At this point, nothing is wrong, but we
are making two round trips.

Unfortunately, the vendor is skirting the standards by returning 401
Unauthorized, but NOT returning the WWW-Authenticate header. This
causes the HttpClient to error out with "Collector responded with HTTP
status 401" and never even try the provided credentials.

With all that being said, I spoke with the vendor again and we're
going to do it a different way, with something on-prem that connects
to /admin/metrics, authenticates, and pulls the data out that way.

Thanks for your time.

[0] https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631724/HttpClientConfiguration#Security-Configuration

-- 
Jeff Tickle (he/him/his)
828-262-7956
Manager, Linux and Research Systems
Information Technology Services