<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The request isnt making it to the idp. I need to do some more testing but the auth header in this case was over 7k. Using my personal account I could see the auth header reach the idp but with the users account it would just "die" and return bad request.
My current theory is that jetty isnt passing the request to the idp so if I could increase the max size of the buffer set aside for headers it may relieve the problem. Also the user reports since his role has changed he may be able to remove a number of groups.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Yeah I read the flow file and saw that it toggles off, runs spnego then cleans up.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px"><font size="2"><font face="Courier New">--<br>
Aterea Brown, AUT University<br>
Cybersecurity, ICT<br>
Email: atbrown@aut.ac.nz Phone: 9219999 x 6523</font></font></div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Wednesday, 10 July 2019 12:09 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: Enforcing SPNEGO</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">> ok tracked it down, user has to0 many AD groups.<br>
<br>
How does that manifest? If nothing else maybe the error could be caught or detected better.<br>
<br>
My vague recollection of the SPNEGO code is that the autorun thing is designed to toggle that off in case the SPNEGO attempt fails so that the next time in it doesn't just keep auto-failing. It re-enables the flag if it succeeds.<br>
<br>
Generally speaking the SPNEGO support is definitely in the category of "supported for members", I don't understand it well enough to support it publically anymore.<br>
<br>
-- Scott<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>