<div dir="ltr">It's very similar -- but we don't seem to have the AH03229: ajp_msg_append_cvt_string(): BufferOverflowException portion. It looks like we have the rest.<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Feb 2, 2023 at 12:07 PM Morgan, Andrew J <<a href="mailto:morgan@oregonstate.edu">morgan@oregonstate.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-606157578350227271">
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
I see an AJP error in my Apache logs several times a day as well. Here is an example from yesterday:</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
[Wed Feb 01 17:08:29.923773 2023] [proxy_ajp:error] [pid 31685] AH03229: ajp_msg_append_cvt_string(): BufferOverflowException 4 770
<div>[Wed Feb 01 17:08:29.923979 2023] [proxy_ajp:error] [pid 31685] [client <a href="http://10.214.152.45:62219" target="_blank">10.214.152.45:62219</a>] AH00971: ajp_marshal_into_msgb: Error appending the header value, referer: <a href="https://jobs.oregonstate.edu/" target="_blank">https://jobs.oregonstate.edu/</a></div>
<div>[Wed Feb 01 17:08:29.924038 2023] [proxy_ajp:error] [pid 31685] [client <a href="http://10.214.152.45:62219" target="_blank">10.214.152.45:62219</a>] AH00988: ajp_send_header: ajp_marshal_into_msgb failed, referer: <a href="https://jobs.oregonstate.edu/" target="_blank">https://jobs.oregonstate.edu/</a></div>
[Wed Feb 01 17:08:29.924073 2023] [proxy_ajp:error] [pid 31685] (120001)APR does not understand this error code: [client <a href="http://10.214.152.45:62219" target="_blank">10.214.152.45:62219</a>] AH00868: request failed to [::1]:8009 (localhost), referer:
<a href="https://jobs.oregonstate.edu/" target="_blank">https://jobs.oregonstate.edu/</a></div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
>From the Apache and IDP logs, this doesn't appear to be a loop. I don't know why the header would be too big, either.</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
We're running this on Debian 10 with their latest apache2 and tomcat9 packages.</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Is this the same error that you are seeing Jeff?</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Thanks,</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Andy</div>
<div style="font-family:Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div id="m_-606157578350227271appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="m_-606157578350227271divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Cantor, Scott via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Sent:</b> Thursday, February 2, 2023 7:27 AM<br>
<b>To:</b> Jeff Chapin <<a href="mailto:jeff.chapin@uni.edu" target="_blank">jeff.chapin@uni.edu</a>><br>
<b>Cc:</b> Cantor, Scott <<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>>; Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Documentation on 'e' and 's' in execution=eXsY</font>
<div> </div>
</div>
<div><font size="2"><span style="font-size:11pt">
<div>[This email originated from outside of OSU. Use caution with links and attachments.]<br>
<br>
> We have seen similar errors in the past when one of our SPs was trying to<br>
> append a *VERY* long header, which was longer than the default header length,<br>
> so I may have jumped to a false conclusion.<br>
<br>
My point is the SP might contaminate its own headers with cookies or what have you, but it can't make the requests to the IdP "bigger" apart from via the request URL or body. It can't "add headers" to the IdP requests.<br>
<br>
As for the IdP, I am not aware of any scenario with loops that changes much about the size of the requests. Cookies get replaced perhaps, but not added.<br>
<br>
Even a full login loop in local storage if it happened would replace the SP record with the new one, the cache doesn't track > 1 session per SP.<br>
<br>
-- Scott<br>
<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C9b6e113a54f7486cd60108db0531fbd7%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638109484452455009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ea%2FV7cpPpViBUJiSYIxVp%2B80ZTyxg9R0lEE7%2FZA%2FRqg%3D&reserved=0" target="_blank">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C9b6e113a54f7486cd60108db0531fbd7%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638109484452455009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ea%2FV7cpPpViBUJiSYIxVp%2B80ZTyxg9R0lEE7%2FZA%2FRqg%3D&reserved=0</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div>
</span></font></div>
</div>
</div></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><pre cols="72">Jeff Chapin,</pre>Panther eSports Adviser <br>Systems/Applications Administrator<br>ITS-IS, University of Northern Iowa<br>Phone: 319-273-3162 Email: <a href="mailto:Jeff.Chapin@uni.edu" target="_blank">Jeff.Chapin@uni.edu</a> </div></div></div></div>