<div dir="ltr">The issue appears to be because something is trying send an image in the Variable-Meta-largeLogo header and that is most likely over 512k. So either your server is misconfigured or whatever is creating the headers is parsing something incorrectly. <div><br></div><div>Sean Portth</div><div>Unicon, Inc.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 16, 2022 at 7:20 AM nicolas roggli via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
I'm trying to setup Nginx with Shibboleth, and I am always getting this <br>
error:<br>
<br>
2022/09/16 12:08:02 [error] 49114#49114: *2629 upstream sent too big <br>
header while reading response header from upstream, client: <br>
10.194.56.230, server: <a href="http://my.server.com" rel="noreferrer" target="_blank">my.server.com</a>, request: "GET /secure HTTP/2.0", <br>
subreq<br>
uest: "/shibauthorizer", upstream: <br>
"fastcgi://unix:/var/run/shibboleth/shibauthorizer.sock:", host: <br>
"<a href="http://my.server.com" rel="noreferrer" target="_blank">my.server.com</a>"<br>
<br>
I tried to raise the buffer size in my config, but I stopped after 512k <br>
as I guess the problem might be elsewhere.<br>
<br>
Has someone any hints on what might happens? I have almost no knowledge <br>
of shibboleth, I don't know what I should look for.<br>
<br>
Part of my nginx.conf<br>
<br>
1 location = /shibauthorizer {<br>
2 internal;<br>
3 include fastcgi_params;<br>
4 fastcgi_pass unix:/var/run/shibboleth/shibauthorizer.sock;<br>
5 }<br>
6<br>
7 location /Shibboleth.sso {<br>
8 include fastcgi_params;<br>
9 fastcgi_pass unix:/var/run/shibboleth/shibresponder.sock;<br>
10 }<br>
11<br>
12 location /shibboleth-sp {<br>
13 alias /usr/share/shibboleth/;<br>
14 }<br>
15<br>
16 location ^~ /secure {<br>
17 shib_request /shibauthorizer;<br>
18 include fastcgi_params;<br>
19 include shib_fastcgi_params;<br>
20 shib_request_set $shib_email $upstream_http_variable_mail;<br>
21 fastcgi_param EMAIL $shib_email;<br>
22 fastcgi_index index.php;<br>
23 fastcgi_param SCRIPT_FILENAME <br>
$document_root$fastcgi_script_name;<br>
24 fastcgi_pass unix:/run/php/php8.1-fpm.sock;<br>
25 }<br>
<br>
Here bellow some more debug output that preceeds the error. I can send <br>
more if needed...<br>
<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http upstream request: <br>
"/shibauthorizer?"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http upstream dummy handler<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http upstream request: <br>
"/shibauthorizer?"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http upstream dummy handler<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http upstream request: <br>
"/shibauthorizer?"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http upstream process header<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 malloc: 000056261F723C00:4096<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 recv: eof:1, avail:-1<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 recv: fd:19 4096 of 4096<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 recv: avail:1416<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 01<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 06<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 00<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 01<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 15<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 63<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 05<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record byte: 00<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi record <br>
length: 5475<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Status: 200 OK"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Variable-AUTH_TYPE: shibboleth"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Variable-Meta-displayName: SWITCH edu-ID [Test]"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Variable-Meta-homeOrganization: <a href="http://test.eduid.ch" rel="noreferrer" target="_blank">test.eduid.ch</a>"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Variable-Meta-homeOrganizationType: others"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Variable-Meta-informationURL: <a href="https://projects.switch.ch/eduid/" rel="noreferrer" target="_blank">https://projects.switch.ch/eduid/</a>"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 posix_memalign: <br>
000056261F71F700:4096 @16<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Variable-Meta-largeLogo: <img <br>
src='data:image/svg+xml\;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9<br>
zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjEiIGlkPSJMYXllcl8xIiB4PSIwcHgiIHk9IjBweCIgd2lkdGg9IjExMyIgaGVpZ2h0PSI4NSIgdmlld0JveD0iMCAwIDgwIDYwIiBzdHlsZT0iZW5hYmxlLWJhY2tncm91bmQ6bmV3IDAgMCA4MCA2M<br>
DsiIHhtbDpzcGFjZT0icHJlc2VydmUiPgo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPgoJLnN0MHtmaWxsOiMwMDI0N0Q7fQo8L3N0eWxlPgo8Zz4KCTxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yLjQsMTMuOWMwLTMuOSwxLjgtNC4zLDUuNC00LjNjMy4yLDAsNS40LDAuMSw1LjMsNC4xaC0xLjdjLTAuMS0yLjY<br>
tMC42LTIuNy0zLjctMi43Yy0zLjIsMC0zLjcsMC40LTMuNywyLjQgICBjMCwyLjgsMS4zLDIuNiw0LjEsMi42YzMuNSwwLjIsNS4yLDAuMSw1LjIsNC4xYzAsNC4xLTEuOSw0LjMtNS42LDQuM1MyLDI0LDIuMywxOS44SDRDMy45LDIzLDQuNiwyMyw3LjcsMjNzNCwwLDQtMi45ICAgYzAtMi44LTEuMi0yL<br>
jMtMy45LTIuNUM0LjgsMTcuNCwyLjQsMTcuNywyLjQsMTMuOXoiLz4KCTxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0zMS41LDI0LjRIMjlsLTMuOC0xMy4yaDBsLTMuOSwxMy4yaC0yLjVMMTQuMyw5LjdIMTZsNCwxMy4zSDIwbDMuOS0xMy4zaDIuNGwzLjksMTMuM2gwbDQuMS0xMy4zaDEuNyAgIEwzMS41LDI<br>
0LjR6Ii8+Cgk8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzkuNSwyNC40aC0xLjdWOS43aDEuN1YyNC40eiIvPgoJPHBhdGggY2xhc3M9InN0MCIgZD0iTTQ3LjYsMjQuNEg0NlYxMS4yaC00LjdWOS43aDExLjF2MS41aC00LjdMNDcuNiwyNC40eiIvPgoJPHBhdGggY2xhc3M9InN0MCIgZD0iTTU3LjksMjQuN<br>
WMtMi43LDAtNC4zLTEuNy00LjMtNC42di01LjdjMC00LjEsMi41LTQuNiw2LjEtNC42aDEuNGMzLjEsMCw0LDEuMyw0LDQuMnYwLjVoLTEuN3YtMC40ICAgYzAtMi0wLjQtMi44LTIuNi0yLjhoLTAuOWMtMy40LDAtNC42LDAuNC00LjYsMy4xdjRjMCwzLjMsMC4xLDQuOCwyLjksNC44aDJjMi43LDAsMy4<br>
1LTAuNCwzLjUtMi41di0xLjJoMS43djEuNCAgIGMwLDMuNC0yLjEsMy43LTUuMSwzLjdMNTcuOSwyNC41eiIvPgoJPHBhdGggY2xhc3M9InN0MCIgZD0iTTc5LjIsMjQuNGgtMS43di02LjdINjl2Ni43aC0xLjZWOS43SDY5djYuNGg4LjZWOS43aDEuN0w3OS4yLDI0LjR6Ii8+CjwvZz4KPGc+Cgk8cGF0a<br>
CBjbGFzcz0ic3QwIiBkPSJNMTQuOSw0Ni44YzAsNC4zLTIuNSw0LjUtNi4zLDQuNWMtNS4yLDAtNi4zLTEuNy02LjMtNi45YzAtNC45LDAuOC03LDYuMy03YzUuNiwwLDYuMywxLjYsNi4zLDcuNkg1LjYgICBjMCwyLjksMC4xLDMuOSwzLDMuOWMxLjgsMCwzLjEsMCwzLjEt<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: 0<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi header: <br>
"Variable-Meta-organizationURL: <a href="http://www.test.eduid.ch/" rel="noreferrer" target="_blank">http://www.test.eduid.ch/</a>"<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 http fastcgi parser: -2<br>
2022/09/16 12:08:02 [debug] 49114#49114: *2629 upstream split a header <br>
line in FastCGI records<br>
2022/09/16 12:08:02 [error] 49114#49114: *2629 upstream sent too big <br>
header while reading response header from upstream, client: <br>
10.194.56.230, server: <a href="http://my.server.com" rel="noreferrer" target="_blank">my.server.com</a>, request: "GET /secure HTTP/2.0", <br>
subreq<br>
uest: "/shibauthorizer", upstream: <br>
"fastcgi://unix:/var/run/shibboleth/shibauthorizer.sock:", host: <br>
"<a href="http://my.server.com" rel="noreferrer" target="_blank">my.server.com</a>"<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>