Shibboleth 4.3 IdP搭配Jetty时Invalid SNI问题求助

一、确认Jetty SNI禁用配置是否生效 #

错误源于Jetty的SecureRequestCustomizer组件，需确保jetty-ssl-context.xml的配置正确且已加载：

• 找到配置中的<Set name="customizers">节点，修改内部的SecureRequestCustomizer实例，添加SNI禁用参数：

<Item>
  <New class="org.eclipse.jetty.server.SecureRequestCustomizer">
    <Set name="sniHostCheck">false</Set>
  </New>
</Item>

• 修改完成后必须重启Jetty服务，确保配置生效。

二、检查证书与FQDN的匹配性 #

SNI错误常因证书不包含服务器完全限定名称（FQDN）导致：

• 使用命令查看证书详情：

keytool -list -v -keystore /path/to/idp/keystore

• 确认证书的Subject Alternative Name（SAN）或Common Name（CN）字段包含目标FQDN。若不匹配，需重新生成对应证书并替换IdP密钥库。

三、统一IdP配置中的URL与FQDN #

确保IdP所有配置项使用一致的FQDN：

• 检查conf/idp.properties中的核心参数：
  • idp.entityID：需为https://你的FQDN/idp/shibboleth格式
  • idp.metadata.entityBaseURL：需与FQDN一致
• 检查conf/metadata-providers.xml中的元数据配置，保证实体ID和回调URL均指向正确的FQDN。

四、强制Jetty忽略SNI的额外配置 #

若上述方法无效，可修改Jetty的HTTP连接器配置：

• 在jetty.xml或jetty-https.xml的<Call name="addConnector">节点内，为SSLContextFactory添加参数：

<Set name="sniRequired">false</Set>

• 重启Jetty服务使配置生效。

错误信息中文翻译 #

HTTP ERROR 400 Invalid SNI
URI: /idp/shibboleth
STATUS: 400
MESSAGE: 无效的SNI
SERVLET: -
CAUSED BY: org.eclipse.jetty.http.BadMessageException: 400: Invalid SNI
Caused by:
org.eclipse.jetty.http.BadMessageException: 400: Invalid SNI
at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:266)
at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:207)
at org.eclipse.jetty.server.HttpChannel.lambda$handle$0(HttpChannel.java:501)
at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:762)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:497)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:282)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:558)
at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:379)
at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:146)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:416)
at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:385)
at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:272)
at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.lambda$new$0(AdaptiveExecutionStrategy.java:140)
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:934)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1078)
at java.base/java.lang.Thread.run(Thread.java:834)

内容的提问来源于stack exchange，提问作者NickH48226