Deirdre Kirmis (Sep 03 2026 at 23:29): Deirdre Kirmis (Sep 03 2026 at 23:29):Hi all .. I've been meaning to ask this question and now it's kind of urgent ..
We are running Dataverse 6.11 on Payara 7 with the standard Apache + mod_proxy_ajp + Shibboleth configuration from the installation guide. We are occasionally seeing mod_proxy_ajp BufferOverflowException / ajp_marshal_into_msgb: Error appending the header value errors during Shibboleth-authenticated requests, resulting in a 400 Bad Request before the request reaches Payara. Our institution's IdP is known to send relatively large SAML-derived headers, and we've previously had to work around header-size issues by stripping cookies on /shib.xhtml.
Has anyone successfully migrated a Dataverse 6.x installation from mod_proxy_ajp to mod_proxy_http with Shibboleth? If so, were there any Dataverse- or Shibboleth-specific configuration changes required beyond updating the Apache proxy configuration?
Philip Durbin 🚀 (Sep 04 2026 at 01:09):In the guides, we definitely promote using AJP, like this:
ProxyPass / ajp://localhost:8009/
But long ago I think I played around with...
ProxyPass / http://localhost:8080/
... and I seem to remember it working. Maybe give it a try on a test server?
Philip Durbin 🚀 (Sep 04 2026 at 01:11):It looks like I took some notes over a decade ago at #2294 if that helps! :sweat_smile:
Philip Durbin 🚀 (Sep 04 2026 at 01:18):Some possible security implications? I'm not sure.
Deirdre Kirmis (Sep 04 2026 at 05:06):Ah yea, if I'm reading that thread right, it seems that method was not really suggested .. is not supported and seems insecure .. so I likely won't go that way .. need to figure out some other way to resolve this header issue .. i did find there is a ProxyIOBufferSize directive that I can add to the apache config .. will try that. Thanks!
Philip Durbin 🚀 (Sep 04 2026 at 11:20):This is the first I've heard of large SAML-derived headers and having to modify shib.xhtml because of them.
I wonder if you can handle this somehow in your Shibboleth config.
For example, @Király Péter was able to remap an attribute from one to another (e.g. from uid to eppn) by specifying a rule in attribute-map.xml.
Of course, this may be completely different from your situation.
If you haven't already, you might want to ask on the shib-users mailing list. I haven't posted in a while but they've always been friendly and responsive.
Deirdre Kirmis (Sep 04 2026 at 15:11):I didn't modify shib.html .. I just added RequestHeader unset Cookie to Location /shib.html in the apache config. I thought that would help but apparently it didn't. Yea I'll ask on the shib-users list .. I've asked things there before. I'm not sure they are SAML headers this is all just a guess, that's why I posted here, just wondering if anyone else has run into this.
Philip Durbin 🚀 (Sep 04 2026 at 15:56):Sure. Maybe @Don Sizemore knows.
Deirdre Kirmis (Sep 04 2026 at 16:30):I did find that Apache was still using the default AJP buffer. After setting ProxyIOBufferSize 65536, the mod_proxy_ajp debug logs now show data to read (max 65530 at 4) instead of the previous 8 KB ?? limit. Leaving this in place to see if it resolves the intermittent BufferOverflowException during shib account creation. :fingers_crossed:
Philip Durbin 🚀 (Sep 04 2026 at 16:42):That would be sweet!
Don Sizemore (Sep 04 2026 at 20:20):I've never encountered this, no. What on earth does your IdP send that's larger than 8kb?
Deirdre Kirmis (Sep 04 2026 at 21:36):the more i look into it the more i think it is not just shib headers, but cookies, shib information, and other request metadata so that the overall authenticated request from ASU headers is too large .. but as I said I'm just guessing at this .. idk
Deirdre Kirmis (Sep 04 2026 at 21:37):we have a similar issue when users make a lot of requests to our vendor e-resources .. after a lot of searching they start to get a "request header too large" error from those vendors because of the org headers added
Last updated: Nov 02 2026 at 07:01 UTC