<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
I see an AJP error in my Apache logs several times a day as well. Here is an example from yesterday:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
[Wed Feb 01 17:08:29.923773 2023] [proxy_ajp:error] [pid 31685] AH03229: ajp_msg_append_cvt_string(): BufferOverflowException 4 770
<div class="ContentPasted0 elementToProof">[Wed Feb 01 17:08:29.923979 2023] [proxy_ajp:error] [pid 31685] [client 10.214.152.45:62219] AH00971: ajp_marshal_into_msgb: Error appending the header value, referer: https://jobs.oregonstate.edu/</div>
<div class="ContentPasted0">[Wed Feb 01 17:08:29.924038 2023] [proxy_ajp:error] [pid 31685] [client 10.214.152.45:62219] AH00988: ajp_send_header: ajp_marshal_into_msgb failed, referer: https://jobs.oregonstate.edu/</div>
[Wed Feb 01 17:08:29.924073 2023] [proxy_ajp:error] [pid 31685] (120001)APR does not understand this error code: [client 10.214.152.45:62219] AH00868: request failed to [::1]:8009 (localhost), referer:
<a href="https://jobs.oregonstate.edu/">https://jobs.oregonstate.edu/</a></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
>From the Apache and IDP logs, this doesn't appear to be a loop. I don't know why the header would be too big, either.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
We're running this on Debian 10 with their latest apache2 and tomcat9 packages.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Is this the same error that you are seeing Jeff?</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
Andy</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott via users <users@shibboleth.net><br>
<b>Sent:</b> Thursday, February 2, 2023 7:27 AM<br>
<b>To:</b> Jeff Chapin <jeff.chapin@uni.edu><br>
<b>Cc:</b> Cantor, Scott <cantor.2@osu.edu>; Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Documentation on 'e' and 's' in execution=eXsY</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">[This email originated from outside of OSU. Use caution with links and attachments.]<br>
<br>
> We have seen similar errors in the past when one of our SPs was trying to<br>
> append a *VERY* long header, which was longer than the default header length,<br>
> so I may have jumped to a false conclusion.<br>
<br>
My point is the SP might contaminate its own headers with cookies or what have you, but it can't make the requests to the IdP "bigger" apart from via the request URL or body. It can't "add headers" to the IdP requests.<br>
<br>
As for the IdP, I am not aware of any scenario with loops that changes much about the size of the requests. Cookies get replaced perhaps, but not added.<br>
<br>
Even a full login loop in local storage if it happened would replace the SP record with the new one, the cache doesn't track > 1 session per SP.<br>
<br>
-- Scott<br>
<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C9b6e113a54f7486cd60108db0531fbd7%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638109484452455009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ea%2FV7cpPpViBUJiSYIxVp%2B80ZTyxg9R0lEE7%2FZA%2FRqg%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C01%7Cmorgan%40oregonstate.edu%7C9b6e113a54f7486cd60108db0531fbd7%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C638109484452455009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ea%2FV7cpPpViBUJiSYIxVp%2B80ZTyxg9R0lEE7%2FZA%2FRqg%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>