<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><meta http-equiv="Content-Type" content="text/html; charset=us-ascii" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I am also using that image. I confirmed that removing jetty-rewrite.xml completely solved my problems. Only removing the last addRule was not enough for me. I guess the question is if there is any reason to have the file at all if both rules have been removed.<br class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Apr 16, 2019, at 13:07, Darren Boss <<a href="mailto:darren.boss@computecanada.ca" class="">darren.boss@computecanada.ca</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">So I think I tracked it down to Jetty configuration. I'm using the Unicon shibboleth-idp-dockerized image although I rebuild it and I do make some minor tweaks as a layer on top of their image.<div class=""><br class=""></div><div class=""><a href="https://github.com/Unicon/shibboleth-idp-dockerized/blob/master/opt/shib-jetty-base/etc/jetty-rewrite.xml" class="">https://github.com/Unicon/shibboleth-idp-dockerized/blob/master/opt/shib-jetty-base/etc/jetty-rewrite.xml</a><br class=""></div><div class=""><br class=""></div><div class="">I think that's the culprit and that last addRule can be removed. If it works I'll create a PR to their project.</div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Apr 16, 2019 at 11:19 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 4/16/19, 9:43 AM, "users on behalf of Darren Boss" <<a href="mailto:users-bounces@shibboleth.net" target="_blank" class="">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:darren.boss@computecanada.ca" target="_blank" class="">darren.boss@computecanada.ca</a>> wrote:<br class="">
<br class="">
> It does look like my problem might be related to running under Kubernetes, specifically that http headers are being set<br class="">
> by the nginx proxy.<br class="">
<br class="">
That doesn't inherently mean the headers are in fact correctly usable out of the box, there still might be a mistake in our understanding.<br class="">
<br class="">
You should NOT need to alter the headers to make logout work, and I have never had to do so in any testing scenarios I've attempted. So either my testing is artificial and doesn't match a real world issue in some way, or people are mistaken somewhere about what Chrome is really saying.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
<br class="">
-- <br class="">
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" class="">users-unsubscribe@shibboleth.net</a><br class="">
</blockquote></div><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div dir="ltr" class="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><p style="margin-bottom:0in;line-height:13px" class=""><font color="#ff0000" class=""><font face="arial, sans-serif" class=""><font style="font-size:10pt" class=""><b class="">Darren Boss</b></font></font></font></p><font style="font-size:10pt" class=""><i class="">Senior Programmer/Analyst</i></font><font style="font-size:10pt" class=""><i class=""><br class="">Programmeur-analyste principal</i></font><font style="font-size:10pt" class=""><i class=""><br class=""><a href="mailto:darren.boss@computecanada.ca" style="color:rgb(17,85,204)" target="_blank" class="">darren.boss@computecanada.ca</a></i></font><font style="font-size:10pt" class=""><i class=""><br class="">(o) 416.228.1234 x </i></font><font class=""><font style="font-size:10pt" class="">230<br class=""></font></font></div><font class=""><font style="font-size:10pt" class=""><i class="">(c) 919.525.0083</i></font></font></div></div></div></div>
-- <br class="">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></div></body></html>