<div dir="ltr"><div dir="ltr">Thanks Scott. However, we are still stuck on this...<div><br></div><div>As I explained in the first message, we have configured in our attribute-resolver a HTTP DataConnector to recover info from an external webservice, and the only way to access it is through a proxy. So far we've tried some options:<br><br> 1. Establish proxy properties on the Operating System -> the IDP omits them<br> 2. Establish proxy properties on the Application server (Tomcat) -> the IDP omits them<br> 3. Establish proxy properties on the IDP (idp.properties) -> the IDP omits them<br><br></div><div>So far so good, because the documentation (<a href="https://wiki.shibboleth.net/confluence/display/IDP30/HttpClientConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/HttpClientConfiguration</a> ) already specifies "some of the components that require or at least support the injection of a custom client bean include: .... a forthcoming HTTPDataConnector for web service access in the attribute resolver"<br><br></div><div>So following your guidance, we modified our services.xml to define some of the beans:<br><br><font face="monospace"> <bean id="httpClientBuilder" class="net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder"><br> <property name="connectionProxyHost" value="<a href="http://proxy-test.example.org/" rel="noreferrer" target="_blank">proxy-test.example.org</a>"/><br> <property name="connectionProxyPort" value="3128"/><br> </bean><br> <bean id="proxyHttpClient" factory-bean="httpClientBuilder" factory-method="buildClient"/><br> <bean id="CustomHttpSecurity" class="org.opensaml.security.httpclient.HttpClientSecurityParameters"><br> <property name="basicCredentials"><br> <bean class="org.apache.http.auth.UsernamePasswordCredentials"<br> c:_0="%{idp.httpclient.resolver.credentials.user}" c:_1="%{idp.httpclient.resolver.credentials.password}" /><br> </property><br> </bean><br><br> <bean id="customCondition" parent="shibboleth.Conditions.RelyingPartyId"><br> <constructor-arg name="candidates"><br> <list><br> <value>urn:amazon:webservices</value><br> <value>arn:aws:iam::579899986493:saml-provider/TESTLABS</value><br> <value>arn:aws:iam::014990139462:saml-provider/TESTLABS</value><br> </list><br> </constructor-arg><br> </bean><br></font><br>On the bean "httpClientBuilder" we set the proxy properties, and on the bean "proxyHttpClient" we build it. This "proxyHttpClient" is used on the attribute-resolver.xml:<br><br></div><div><font face="monospace"> <DataConnector id="apiGW" xsi:type="HTTP"<br> httpClientRef="proxyHttpClient"<br> httpClientSecurityParametersRef="CustomHttpSecurity"<br> activationConditionRef="customCondition"<br> validatorRef="shibboleth.NonFailFastValidator"<br> acceptStatuses="200 404 400 500 503"<br> ><br></font><br>What we have seen is that Shibboleth IDP seems to omit the configuration of the bean declared on "httpClientRef", but other beans as "activationConditionRef" and "httpClientSecurityParametersRef" are correctly retrieved.<br><br>On the IDP logs we can see, that the attribute-resolver detects that needs to use apiGW (so activationConditionRef OK), but the request is sent directly to the webservice (<a href="https://informacio-test.example.org/" rel="noreferrer" target="_blank">https://informacio-test.example.org</a>) and not the proxy (<a href="http://proxy-test.example.org/" rel="noreferrer" target="_blank">proxy-test.example.org</a>)<br><br><font face="monospace">2021-05-12 14:34:13,987 - TRACE [net.shibboleth.idp.attribute.resolver.dc.impl.AbstractSearchDataConnector:184] - Data Connector 'apiGW': Cache found, resolved attributes null using cache com.google.common.cache.LocalCache$LocalManualCache@32089fe9<mailto:<a href="mailto:com.google.common.cache.LocalCache" target="_blank">com.google.common.cache.LocalCache</a>$LocalManualCache@32089fe9><br>2021-05-12 14:34:13,987 - DEBUG [org.apache.http.client.protocol.RequestAddCookies:123] - CookieSpec selected: default<br>2021-05-12 14:34:13,988 - DEBUG [org.apache.http.client.protocol.RequestAuthCache:77] - Auth cache not set in the context<br>2021-05-12 14:34:13,988 - DEBUG [org.apache.http.impl.conn.PoolingHttpClientConnectionManager:255] - Connection request: [route: {s}-><a href="https://informacio-test/" target="_blank">https://informacio-test</a>.example.org:443][total kept alive: 0; route allocated: 0 of 100; total allocated: 0 of 100]<br>2021-05-12 14:34:13,989 - DEBUG [org.apache.http.impl.conn.PoolingHttpClientConnectionManager:288] - Connection leased: [id: 3][route: {s}-><a href="https://informacio-test/" target="_blank">https://informacio-test</a>.example.org:443][total kept alive: 0; route allocated: 1 of 100; total allocated: 1 of 100]<br>2021-05-12 14:34:13,989 - DEBUG [org.apache.http.impl.execchain.MainClientExec:235] - Opening connection {s}-><a href="https://informacio-test.example.org/" rel="noreferrer" target="_blank">https://informacio-test.example.org:443</a><br>2021-05-12 14:34:14,036 - DEBUG [org.apache.http.impl.conn.DefaultHttpClientConnectionOperator:139] - Connecting to <a href="http://informacio-test.example.org/123.456.789.000:443" rel="noreferrer" target="_blank">informacio-test.example.org/123.456.789.000:443</a><br></font><br>After two minutes, the Data Connector fails because we cannot exit directly to Internet:<br><br><font face="monospace">2021-05-12 14:36:14,105 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:314] - Profile Action ResolveAttributes: Error resolving attributes<br>net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'apiGW': HTTP request failed at net.shibboleth.idp.attribute.resolver.dc.http.impl.HTTPDataConnector.retrieveAttributes(HTTPDataConnector.java:109)<br>Caused by: org.apache.http.conn.ConnectTimeoutException: Connect to <a href="http://informacio-test.example.org:443/" rel="noreferrer" target="_blank">informacio-test.example.org:443</a> [<a href="http://informacio-test.example.org/223.456.789.000" rel="noreferrer" target="_blank">informacio-test.example.org/223.456.789.000</a>, <a href="http://informacio-test.example.org/123.456.789.000" rel="noreferrer" target="_blank">informacio-test.example.org/123.456.789.000</a>] failed: connect timed out<br> at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151)<br>Caused by: <a href="http://java.net/" target="_blank">java.net</a>.SocketTimeoutException: connect timed out at java.net.PlainSocketImpl.socketConnect(Native Method)</font><br><br>Has anybody succeeded with this? Maybe an example of a bean definition, for an HttpClient with proxy to be used on the Attribute Resolver? Any help would be appretiated.</div><div><br>Thanks a lot<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">El mié, 5 may 2021 a las 17:36, Cantor, Scott (<<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>>) escribió:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 5/5/21, 11:10 AM, "users on behalf of Manolo Garcia Alvarez" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:mgarciaal@uoc.edu" target="_blank">mgarciaal@uoc.edu</a>> wrote:<br>
<br>
> The HTTPConnector works just fine when there is direct access to the service, but when we use an HTTP proxy<br>
> (adding https.proxyHost and https.proxyPort in the Tomcat bootstrap), the HTTPConnector seems to ignore it.<br>
<br>
I certainly hope so.<br>
<br>
> Has anybody successfully used the HTTPConnector with a proxy? Is there any additional configuration for the<br>
> HTTPConnector?<br>
<br>
Most of the HTTP client settings are in the javadocs [1] for the builder base class the HttpClient factory bean is based on.<br>
<br>
-- Scott<br>
<br>
[1] <a href="https://build.shibboleth.net/nexus/content/sites/site/java-support/8.2.0/apidocs/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.html?is-external=true" rel="noreferrer" target="_blank">https://build.shibboleth.net/nexus/content/sites/site/java-support/8.2.0/apidocs/net/shibboleth/utilities/java/support/httpclient/HttpClientBuilder.html?is-external=true</a><br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br></div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><br><hr><span style="font-family:Verdana,Tahoma;font-size:11px;color:rgb(46,58,105)"><span style="font-weight:bold">Manolo García</span> <br>Arquitectura i Sistemes<br><span style="font-weight:bold">Universitat Oberta de Catalunya</span> <br></span> <br><font color="#4d4d4d" face="Verdana, Tahoma"><span style="font-size:11px">689 88 30 93 </span></font><span style="color:rgb(77,77,77);font-family:Verdana,Tahoma;font-size:11px">| </span><a href="mailto:mgarciaal@uoc.edu" style="font-family:Verdana,Tahoma;font-size:11px" target="_blank">mgarciaal@uoc.edu</a><span style="color:rgb(77,77,77);font-family:Verdana,Tahoma;font-size:11px"> </span></div><div dir="ltr"><span style="font-family:Verdana,Tahoma;font-size:11px;color:rgb(77,77,77)"><div dir="ltr"><div dir="ltr">Parc Mediterrani de la Tecnologia (edifici B3)</div><div dir="ltr">Av. Carl Friedrich Gauss, 5.</div><div dir="ltr">08860 Castelldefels</div></div></span><img alt="Universitat Oberta de Catalunya" src="http://cv.uoc.edu/WebMail/resources/img/UOC_e_mail.gif" style="border: medium none;"> <br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br>
<div style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></div><div><p style="list-style-type:none;padding:0px;margin:0px;line-height:1.38;background-color:rgb(255,255,255);border-left-style:none;border-right-style:none;border-top-style:none"><font color="#808080" face="Arial" size="1">INFORMACIÓ SOBRE PROTECCIÓ DE DADES DE LA UNIVERSITAT OBERTA DE CATALUNYA (UOC)</font></p><p style="list-style-type:none;padding:0px;margin:0px;line-height:1.38;background-color:rgb(255,255,255);border-left-style:none;border-right-style:none;border-top-style:none"><font color="#808080" face="Arial" size="1">Us informem que les vostres dades identificatives i les contingudes en els missatges electrònics i fitxers adjunts es poden incorporar a les nostres bases de dades amb la finalitat de gestionar les relacions i comunicacions vinculades a la UOC, i que es poden conservar mentre es mantingui la relació. Si ho voleu, podeu exercir el dret a accedir a les vostres dades, rectificar-les i suprimir-les i altres drets reconeguts normativament adreçant-vos a l'adreça de correu emissora o a <a href="mailto:fuoc_pd@uoc.edu" target="_blank">fuoc_pd@uoc.edu</a>.</font></p><p style="list-style-type:none;padding:0px;margin:0px;line-height:1.38;background-color:rgb(255,255,255);border-left-style:none;border-right-style:none;border-top-style:none"><font color="#808080" face="Arial" size="1">Aquest missatge i qualsevol fitxer que porti adjunt, si escau, tenen el caràcter de confidencials i s'adrecen únicament a la persona o entitat a qui s'han enviat.</font></p><p style="list-style-type:none;padding:0px;margin:0px;line-height:1.38;background-color:rgb(255,255,255);border-left-style:none;border-right-style:none;border-top-style:none"><font color="#808080" face="Arial" size="1">Així mateix, posem a la vostra disposició un delegat de protecció de dades que no només s'encarregarà de supervisar tots els tractaments de dades de la nostra entitat, sinó que us podrà atendre per a qualsevol qüestió relacionada amb el tractament de dades. La seva adreça de contacte és <a href="mailto:dpd@uoc.edu" target="_blank">dpd@uoc.edu</a>.</font></p></div><hr><div><div><div><font color="#808080" face="Arial" size="1">INFORMACIÓN SOBRE PROTECCIÓN DE DATOS DE LA UNIVERSITAT OBERTA DE CATALUNYA (UOC)</font></div><div><font color="#808080" face="Arial" size="1">Os informamos de que vuestros datos identificativos y los contenidos en los mensajes electrónicos y ficheros adjuntos pueden incorporarse a nuestras bases de datos con el fin de gestionar las relaciones y comunicaciones vinculadas a la UOC, y de que pueden conservarse mientras se mantenga la relación. Si lo deseáis, podéis ejercer el derecho a acceder a vuestros datos, rectificarlos y suprimirlos y otros derechos reconocidos normativamente dirigiéndoos a la dirección de correo emisora o a <a href="mailto:fuoc_pd@uoc.edu" target="_blank">fuoc_pd@uoc.edu</a>.</font></div><div><font color="#808080" face="Arial" size="1">Este mensaje y cualquier fichero que lleve adjunto, si procede, tienen el carácter de confidenciales y se dirigen únicamente a la persona o entidad a quien se han enviado.</font></div><div><font color="#808080" face="Arial" size="1">Así mismo, ponemos a vuestra disposición a un delegado de protección de datos que no solo se encargará de supervisar todos los tratamientos de datos de nuestra entidad, sino que podrá atenderos para cualquier cuestión relacionada con el tratamiento de datos. Su dirección de contacto es <a href="mailto:dpd@uoc.edu" target="_blank">dpd@uoc.edu</a>.</font></div></div></div><hr><div><font color="#808080" face="Arial" size="1"><span style="background-color:white">UNIVERSITAT OBERTA DE CATALUNYA (UOC) DATA PROTECTION </span><span style="background-color:white">INFORMATION</span></font></div><div><div><font face="Arial" color="#808080" size="1">Your personal data and the data contained in your email messages and attached files may be stored in our databases for the purpose of maintaining relations and communications linked to the UOC, and the data may be stored for as long as these relations and communications are maintained. If you so wish, you can exercise your rights to access, rectification and erasure of your data, and any other legally held rights, by writing to the sender’s email address or to <a href="http://fuoc_pd@uoc.edu" target="_blank">fuoc_pd@uoc.edu</a>.</font></div><div><font face="Arial" color="#808080" size="1">This message and, where applicable, any attachments are confidential and addressed solely to the individual or organization they were sent to.</font></div><div><font face="Arial" color="#808080" size="1">The UOC has a data protection officer who not only supervises the data processing carried out at the University, but who will also respond to any questions you may have about this data processing. You can contact our data protection officer by writing to <a href="http://dpd@uoc.edu" target="_blank">dpd@uoc.edu</a>.</font></div></div><div style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"><br></div>