search

eclipse-pass / main

Catch all repository against which issues of general, cross cutting topics are logged.
Apache License 2.0
4 stars 8 forks source link

Requests from outside world are not entirely blocked by shib #86

Open birkland opened 5 years ago

birkland commented 5 years ago

This is at least on test, have not looked elsewhere

See requests in the log

For example, from the fcrepo logs:

[26/Nov/2018:22:27:59 +0000] http-nio-8080-exec-6 5.232.222.233 - - 500 status, 4 ms, 1129 bytes; "GET / HTTP/1.1" Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7

These all seem to be for /. Any request outside of fedora and the user service will fail with a 500 error, due to a global servlet filter that assumes that it has access to the context of one of these webapps. So the proxy rules should be updated to eliminate the possibility of such requests.

derekbelrose commented 5 years ago

here is what is happening right now:

ProxyPassReverse /fcrepo https://${FCREPO_HOST}:${FCREPO_PORT}/fcrepo/
ProxyPass /fcrepo ajp://${FCREPO_HOST}:8009/fcrepo

Can you please restate what you expect the proxy to do and in what situations you expect it to happen?

derekbelrose commented 5 years ago

looking at the logs, it appears you want me to proxy for /fcrepo/rest and not for /fcrepo.

Is this correct?

birkland commented 5 years ago

It's more along the lines of "assure that every request to Fedora, the user service, or its tomcat container originating from the public network passes through shibboleth"

The logged request came in on the http connector, not the ajp connector as anticipated. The ProxyPass directive looks good. However, it seems like this request took another path in. So this ticket is to figure out how that un-authenticated and un-shibbolized request got to fedora, and assure that such requests won't make it to Fedora at all. There should never be http requests from the outside world that reach Fedora's tomcat container. They should be AJP (from the proxy), and protected by the shibboleth SP

derekbelrose commented 5 years ago

I might have hit that from curl to make sure it was up and running.

That would have done it, right? curl http://fcrepo-test.pass.local:8080/

See the latest container log which would not have been used by anyone coming in from the load balancer as it wasn't being routed by the load balancer:

see the cloudwatch log from the latest container