problem with very long URLs

[Gail Lewis]

I've been working on bringing Shibboleth authentication into one of our
Tomcat webapps. I'm using lazy sessions, as most requests to our
application do not require authentication and should just pass through
Shibboleth. One of those requests that should just pass through
generates very long URLs. There appears to be a problem when the URL
length exceeds 1000 characters.

When the length is just under 1000 characters, it works fine. I can see
shib_check_user and shib_auth_checker entries generated in the
native.log file.

At just over 1000 characters, nothing comes back to the browser. In the
apache error_log, I get an entry like "child pid 15788 exit signal
Segmentation fault (11)", and there are no shib_check_user and
shib_auth_checker entries in native.log.

If I remove

<Location />
AuthType shibboleth
ShibRequireSession Off
ShibUseHeaders On
require shibboleth
</Location>

from shib.conf in the apache configuration files, the long URL (over
1000 char) works fine (but of course the other requests requiring lazy
session authentication stop working).

I tried searching the list archives with no luck. Is this a known issue?

We are running Shibboleth version 2.2.1 on CentOS release 5.4.

Thanks,

Gail Lewis

--
To unsubscribe from this group, send email to
users+un...@shibboleth.net

[Cantor, Scott E.]

On 7/5/11 1:17 PM, "Gail Lewis" <gel...@ufl.edu> wrote:
>
>I tried searching the list archives with no luck. Is this a known issue?

No, please file a bug and supply a sample...

>We are running Shibboleth version 2.2.1 on CentOS release 5.4.

...after updating to a supported release (2.4.2) and confirming the bug.

-- Scott

[Cantor, Scott E.]

Initial attempts to cause a problem with > 1024 characters worked fine.

I might speculate logging's involved, but I have it turned up fairly high
myself.