<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Aptos",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi Scott,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks for testing out Jetty 12. It’s good to know that things should be working.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I will plan to file a support issue for this, and I believe I’m already on the list that should be able to do that.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">However, I added the MDCHeaders bean in global.xml like so:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <util:map id="shibboleth.MDCHeaders"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <entry key="idp.headers.x-remote-user" value="X-Remote-User" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </util:map><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">And I modified the pattern for the idp-process.log to show the header value:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <Pattern>%date{ISO8601} - %mdc{idp.remote_addr} - %mdc{idp.headers.x-remote-user} - %level [%logger:%line] - %msg%n%ex{short}</Pattern><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The header is blank on every log entry, as expected, except for the middle line below:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">====<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2024-07-23 10:28:58,983 - 172.18.8.29 - - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:233] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'UseCert'
event to 'authn/RemoteUser' flow<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2024-07-23 10:29:01,764 - 172.18.8.29 - cak0l - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:277] - e1s3: User identity not found in request<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">2024-07-23 10:29:01,791 - 172.18.8.29 - - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:201] - Profile Action ValidateExternalAuthentication: External authentication failed, no user identity
or error information returned<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">====<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The header value is present and correct, but is still not getting processed by the RemoteUser servlet.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Does anything come to mind about why the RemoteUser servlet isn’t scooping that up?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I can still file a support issue, but the fact that the header is showing up with the right value at least means Jetty is not shaving it off. Perhaps the issue is simpler than it seemed, I hope…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Chris<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-- <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Chris Koeritz<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Senior Linux and Storage Engineer <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">University of Virginia ITS - Backup, Storage, and Archive Services<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">P: 434 982 4690<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Cantor, Scott <cantor.2@osu.edu><br>
<b>Date: </b>Tuesday, July 23, 2024 at 8:14</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black">AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Koeritz, Chris (cak0l) <cak0l@virginia.edu><br>
<b>Subject: </b>Re: Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">Given that you're members, I did run a quick test. At least under Eclipse, Jetty 12 handles a smuggled in X-Remote-User header just fine, the flow worked without any unusual steps.
I was expecting to find a regression in the RemoteUser servlet, but I'm not seeing one.<br>
<br>
Because you're members, I'm willing to assist, but you'd have to file a support issue (If you don't have access, I can connect you with the person at UV who can add you). I don't offhand know what to suggest at this point though, other than logging some headers
to get more insight.<br>
<br>
I don't think it's possible that your HTTP traces are accurate, I'm afraid. Something is stripping the header before it reaches the web server, but the logging should prove that.<br>
<br>
-- Scott<br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>