<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Aptos",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi Scott,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I tried switching from the “X-Remote-User” header to “Sec-Fetch-Mode” in the RemoteUser area of the authn.properties file. That header is also present in the tcpdump output. I still got:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2024-07-22 16:38:38,652 - 172.18.8.29 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:277] - e1s3: User identity not found in request<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I tried with two other headers that should definitely be present (according to the tcpdump), “Priority” and “Connection”, and got the same result.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">These obviously would have the wrong user ID value if they worked, but they all seemed to fail in the same way as X-Remote-User, for whatever reason.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Our startup time does seem slow, but includes the IdP startup. We have about 650 Service Providers’ metadata and about 320 attribute filter definitions. I’m not sure if that explains the additional startup
time, or if our VM is just underpowered compared to the host you’re running on. This startup delay seems consistent with our production Shib IdP v4 systems also.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Chris<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Chris Koeritz<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Senior Linux and Storage Engineer <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">University of Virginia ITS - Backup, Storage, and Archive Services<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">P: 434 982 4690<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Cantor, Scott <cantor.2@osu.edu><br>
<b>Date: </b>Monday, July 22, 2024 at 4:22</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black">PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Koeritz, Chris (cak0l) <cak0l@virginia.edu><br>
<b>Subject: </b>Re: Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">My advice, assuming you have a suitable dev environment, is to point it at an obviously ridiculous but known to be "present" header, and see if it pulls that in properly.<br>
<br>
No reason it shouldn't work, but I wonder if the "X-" syntax is causing an issue.<br>
<br>
We don't log headers.<br>
<br>
> With the normal “INFO” level logging, Jetty starts up within <br>
> 39 seconds on our development host.<br>
<br>
Mine takes like 5 seconds. The rest is the IdP getting going, and even that only takes maybe 10 more. That doesn't sound right to me.<br>
<br>
-- Scott<br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>