IOPLEX

Jespa Technical Documentation

Learn / Increasing Request Header Size for Users in Many Groups
Install the HttpSecurityService for Windows Silent SSO with SPNEGO Install the Jespa Example Webapp Diagnosing and Fixing Issues with Kerberos Possible Issues using the HttpSecurityService The HssSetup Console Menu Program How Silent SSO with SPNEGO Over HTTP Works SPNEGO Silent SSO with Apache Tomcat and a Self-Signed Certificate Manually Create the Computer Account for the HttpSecurityService Upgrading a Pre-Jespa 2.1 Installation for Windows Silent SSO with SPNEGO
Increasing Request Header Size for Users in Many Groups

Increasing Request Header Size for Users in Many Groups

If the Authorization header is too large for the application server, such as because there are many group SIDs in the PAC of the Kerberos ticket in the SPNEGO token, it will be necessary to increase the maximum header size.

If the HSS properties file has jespa.log.level = 4 (or higher), Jespa will log the group count and size of the Authorization header like: 

Authn success: KRB5: SEBANK\hinves
Header Size: 440 groups / 7101 bytes
Log entry of group count and Authorization header size

For an explicit login, such as with a login form, there is no such header. However, Jespa does log an estimate of what the header size would be like: 

Login success: KRB5: SEBANK\hinves
Header Size: 440 groups / 7104 bytes (estimated)
Log entry of group count and estimated Authorization header size for an explicit login

This feature (or the Jespa example webapp) might be used to check a user's token size without triggering an error.

Tomcat, Jetty, WildFly, ...

Each application server has different directives for setting the maximum request header size. Below are examples for Tomcat and Jetty. Interpolate as necessary for WildFly, Spring, etc.

The Tomcat maxHttpHeaderSize Connector Attribute

If Tomcat logs "Request header is too large" errors, edit $CATALINA_BASE/conf/server.xml and modify the Connector element to include a maxHttpHeaderSize="32768" attribute.

For example, a typical Connector section for an HSS protected application might look like: 

<Connector
    port="8443"
    protocol="org.apache.coyote.http11.Http11NioProtocol"
    maxHttpHeaderSize="32768"
    scheme="https"
    secure="true"
    SSLEnabled="true">
    <SSLHostConfig>
        <Certificate
            certificateKeystoreType="JKS"
            certificateKeystoreFile="conf/jespa15.jks"
            certificateKeystorePassword="jespa15"/>
    </SSLHostConfig>
</Connector>
Increasing the maxHttpHeaderSize in Apache Tomcat

The Jetty jetty.httpConfig.requestHeaderSize jetty-start Property

If Jetty logs "Request header too large" errors, create or edit $JETTY_BASE/start.ini and add a line: 

jetty.httpConfig.requestHeaderSize=32768
Increasing the jetty.httpConfig.requestHeaderSize property in Jetty

This property can also be set in other ways (such as part of an HttpConfiguration).

See also: Problems with Kerberos authentication when a user belongs to many groups
See also: Logging on a user account that is a member of more than 1,010 groups may fail on a Windows Server-based computer