<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:10pt;color:#000000;background-color:#FFFFFF;font-family:Verdana, Geneva, sans-serif;">
<p>Dear Scott,</p>
<p><br>
</p>
<p>thanks for your reply. I'm sorry, I should have explained my situation better. What I was hoping for by writing to this list was a way to narrow down the cause of my problem. Some hints how to debug this problem and find it's cause.</p>
<p><br>
</p>
<p><br>
</p>
<p>About the need to tune the config files of jetty 9.3.10 to get the IDP to work as well as it did with 9.3.6, here's a list of what I did:</p>
<p><br>
</p>
<p><span>-) add the java startup parameter "<span>-Djava.security.egd=file:/dev/./urandom" to line 353 of jetty.sh to get rid of startup delay</span></span></p>
<p><span><span><br>
</span></span></p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">-) </span><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">copy</span><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;"> the
keystore file </span><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">to </span><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">jetty/etc/keystore</span><span style="font-size: 13.3333px;"> and
save it's passwords into the appropriate places of </span><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">jetty-ssl-context.xml</span><br>
</p>
<p><br>
</p>
<p>-) add list of <span>excluded CipherSuites to <span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">jetty-ssl-context.xml to
make firefox accept the https connection:</span></span></p>
<p></p>
<div> <Set name="ExcludeCipherSuites"></div>
<div> <Array type="String"></div>
<div> <Item>SSL_RSA_WITH_DES_CBC_SHA</Item></div>
<div> <Item>SSL_DHE_RSA_WITH_DES_CBC_SHA</Item></div>
<div> <Item>SSL_DHE_DSS_WITH_DES_CBC_SHA</Item></div>
<div> <Item>SSL_RSA_EXPORT_WITH_RC4_40_MD5</Item></div>
<div> <Item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</Item></div>
<div> <Item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</Item></div>
<div> <Item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</Item></div>
<div> </Array></div>
<div> </Set></div>
<p></p>
<p></p>
<p style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">
<br class="Apple-interchange-newline">
-) add rule to get our favicon to be used to jetty-rewrite.xml</p>
<p style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">
</p>
<div> <Call name="addRule"></div>
<div> <Arg></div>
<div> <New class="org.eclipse.jetty.rewrite.handler.RewritePatternRule"></div>
<div> <Set name="pattern">/favicon.ico</Set></div>
<div> <Set name="replacement">/idp/favicon.ico</Set></div>
<div> </New></div>
<div> </Arg></div>
<div> </Call></div>
<div><br>
</div>
<div><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">-) add rule to prevent browsers to ask for http version (which reduces
risk of man-in-the-middle attacks) to jetty-rewrite.xml</span><br>
</div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><Call name="addRule"></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> <Arg></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span><New class="org.eclipse.jetty.rewrite.handler.HeaderPatternRule"></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> <Set name="pattern">*</Set></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> <Set name="name">Strict-Transport-Security</Set></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> <Set name="value">max-age=31536000; includeSubDomains</Set></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></New></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> </Arg></div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span></Call></div>
<div><br>
</div>
<div>-) copy block from <a href="https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration" class="OWAAutoLink" id="LPlnk478231">https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration</a> into jetty.xml to allow JAAS to function:</div>
<div>
<div> <Call name="addBean"></div>
<div> <Arg></div>
<div> <New class="org.eclipse.jetty.jaas.JAASLoginService"></div>
<div> <Set name="name">ShibUserPassAuth</Set></div>
<div> <Set name="LoginModuleName">ShibUserPassAuth</Set></div>
<div> </New></div>
<div> </Arg></div>
<div> </Call></div>
</div>
<div><br>
</div>
<p></p>
-) copy start.d directory with https, jaas, rewrite and ssl ini files from old jetty installation
<p></p>
<p><br>
</p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">-) copy idp.xml into the new webapps directory</span><br>
</p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;"><br>
</span></p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;"><br>
</span></p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">Thanks for your help,</span></p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">kind regards,</span></p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;">Thomas Käfer</span></p>
<p><span style="font-family: Verdana, Geneva, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 13.3333px;"><br>
</span></p>
<div></div>
</div>
</body>
</html>