<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Hi List,</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">thanks to a hint by Scott via the
Consortium's member chat, this could be resolved: Error 403 is a
hint that a newer Tomcat would not accept the attributes injected
by the SP. To make Tomcat accept the SP's attributes, the property
<span style="color: rgb(68, 68, 68); font-family: Inter,
-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
Oxygen, Ubuntu, Cantarell, "Helvetica Neue",
"Apple Color Emoji", "Segoe UI Emoji",
"Segoe UI Symbol", "Meiryo UI", Arial,
sans-serif; font-size: 14px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgb(247, 248,
250); text-decoration-style: initial; text-decoration-color:
initial; display: inline !important; float: none;">*allowedRequestAttributesPattern*</span>
in Tomcat's configuration must be set to a regular expression
matching the expected attribute names. See
<a class="moz-txt-link-freetext" href="https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html">https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html</a><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Hope this helps others,</div>
<div class="moz-cite-prefix">Martin<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Am 07.07.21 um 14:02 schrieb Martin
Haase:<br>
</div>
<blockquote type="cite"
cite="mid:7cfa2f21-291a-fc17-c49c-120661997f7c@DAASI.de">
<pre class="moz-quote-pre" wrap="">Dear List,
maybe someone in here has already done this. We have installed a current
SP on Linux with Apache2.4 that proxies via AJP to a Tomcat that runs a
ColdFusion Application. We have issues with seeing attributes at the
application. A variable like "CGI.EPPN", "CGI.HTTP_EPPN" etc. would not
be available for dump although "eppn" is visible in the session, and
"AJP_eppn" in phpinfo() as well.
We tried both passive and active protection of <Location />, with
ProxyPass of "/" to ajp://localhost (excluding the Shib Handler URL).
Do you have any idea?
Cheers
Martin
P.S: Maybe this has something to do with it: The application seems to
require a "Require all granted" in its <Location>. However, when I want
to use passive protection and say "Require shibboleth", then these two
directives seem to disturb each other. As soon as I comment the "Require
all granted", the application would answer with a HTTP 403.
</pre>
</blockquote>
<p><br>
</p>
</body>
</html>