RE: Siteminder/mod_proxy issues

RE: Siteminder/mod_proxy issues

am 29.08.2002 14:44:45 von agfoust

> Does anyone know a browser-like test tool which handles
> SSL and shows the actual data including headers ? I might
> even build one myself, since debugging these issues is
> now quite a pain in the *ss. I know there is an SSL ca-
> pable wget, but it's pretty irritating with cookies etc.

I ran into exactly this problem. I believe you would either
have to capture the SSL traffic at the application level on
the server or client, before or after it's encrypted/
decrypted; sniffers and intermediate proxies cannot decode
SSL. This is by design.

I use a commercial tool called TracePlus/WebDetective for
Windows platform.
http://www.sstinc.com/home_winsock.html
It's shareware (costs about $200 US to register) and is a
very good tool. There may be others, but I haven't found
any. It intercepts the traffic at the desktop level before
it's encrypted and will capture the headers and data flow
for any winsock-based application, not just browsers (e.g.
this works for Mozilla, IE, Acrobat, etc).

My main workstation platform is Linux, but the majority of
our end users are Win32 IE 5 and 6, so I run the TracePlus
tool on a diagnostic Windows laptop. It would be very nice
to discover a way to do this sort of SSL sniffing in a
cross-platform manner (Linux, Solaris, HP/UX, etc).


-----Original Message-----
From: Martijn Schoemaker [mailto:martijn@osp.nl]
Sent: Thursday, August 29, 2002 7:28 AM
To: modproxy-dev@apache.org
Subject: Re: Siteminder/mod_proxy issues

Hi,

We use SM 4.51 and not yet the QMR4 web-agent. Will install
and try this out right away. In any case, this does not seem
to be a mod_proxy problem anyway. I did some more checking
and the browser problems are probably caused by the Set-Cookie
headers which are set multiple times. Also, the Cookies them-
selves for the user that works are smaller that the ones for
the user that don't work and this prolly gives strange effects
in IE (who whould have guessed ? :))

Anyway, this seems more like a SM/Cookie/RFC issue and has no
further relation with mod_proxy.

Thanks all who replied for the input, and if insights change
y'all will hear from me :)

Greetings,
Martijn Schoemaker

P.S.: Does anyone know a browser-like test tool which handles
SSL and shows the actual data including headers ? I might
even build one myself, since debugging these issues is
now quite a pain in the *ss. I know there is an SSL ca-
pable wget, but it's pretty irritating with cookies etc.

"Foust, Adam G." wrote:

> We are beginning a Apache 1.3.26 reverse-proxy setup with SiteMinder. I
have
> not seen the double Set-Cookie strangeness. We are using SiteMinder 4.61
> with the QMR4 apache webagent. I've observed some strange URL rewriting
> issues involved with multi-domain sign-on and using cookie providers, but
> nothing that can't be worked around.
>
> Our setup is basically apache reverse-proxies (mod_proxy) behind F5
> load-balancers. The reverse-proxies chain through intermediate firewalls
> through another (forward) mod_proxy to backend DMZ servers.
>
> I have been tracing HTTP headers and have not yet seen the behavior you
> describe. Are you running SiteMinder 5.0?
>

--
You have reached the end of the message.
Press [t] to go to the top of this message, or [c] to close it.

Re: Siteminder/mod_proxy issues

am 29.08.2002 16:31:27 von Eli Marmor

By the way:

Is the following possible?

I want to record *ENCRYPTED* sessions (requests+responses), and later
give the recorded data to the owner of the private key. I want to
supply him a program that will take his private key and use it to
decrypt the data to readable requests and responses.

Has anybody experienced a similar project?

Did anybody know if it is possible?

Any tip?

Thanks,
--
Eli Marmor
marmor@netmask.it
CTO, Founder
Netmask (El-Mar) Internet Technologies Ltd.
__________________________________________________________
Tel.: +972-9-766-1020 8 Yad-Harutzim St.
Fax.: +972-9-766-1314 P.O.B. 7004
Mobile: +972-50-23-7338 Kfar-Saba 44641, Israel