Adobe provided Isapi_redirect.dll connection to standalone Tomcat Server

[JakinH]

We have an old but important website that we are in the process of bringing into the 21st century. The front-end is IIS with multiple backend servers including Cold Fusion and a standalone Tomcat 8.5 running with java 7 on Linux. This configuration is working fine with the current configuration using Cold Fusion 9 and the corresponding isapi_redirect.dll provided with CF9.

As soon as we upgrade to anything newer than CF9, connections to the standalone Tomcat servers through isapi_redirect start to fail. Packet captures seem to indicate that there is significantly more data being sent to AJP from the newer isapi_redirect than before. We have tried using all versions of isapi_redirect from Adobe newer than CF9 and they all fail to talk nice to a tomcat server. Alternatively, if we use the isapi_redirect from the apache foundation, tomcat works, but Cold Fusion fails.

It certainly appears that Adobe has made customizations to their version of isapi_redirect that are incompatible with standard AJP, but we can't be sure. It may simply be that our current tomcat configuration needs to be modified in such a way to be able to talk nice to the Adobe provided connector. Due to the use of site auth tokens and various other integrations, separating out these backends using redirects, iframes, or other similar tactics is not an easy task, so using multiple connectors in IIS is not feasible.

Is anyone aware of a configuration where the current Adobe provided isapi connector can connect via AJP to a standalone Tomcat server?

[BKBK]

This is definitely a module-integration problem. I would start by looking into the cross-compatibility of the 3 main modules in use:

1.  ColdFusion;
2.  Standalone Tomcat;
3.  Java.

Newer versions of ColdFusion run on more recent Tomcat and Java versions, and create modified connectors.

[JakinH]

Thank you @BKBK ,

  We will be testing with newer versions of standalone Tomcat to see if that makes a difference, although I'm not too optimistic since the AJP protocol itself hasn't changed in forever.  Do we have any insight into what modifications were made to the connector?  The documentation I can find simply states that the isapi_redirect.dll provided is "based" off of the apache one...which would seem to indicate its been tweeked.  My fear is that the tweaks make it proprietory and we're in for some serious redevelopment work.

[Priyank Shrivastava.]

Hi @JakinH 

if you are moving to CF2021/CF2023, then Tomcat 8.x won't work as it is not the supported version. You need to at least move to Tomcat 9.x. If you are using J2EE deployment then we don't provide isapi_redirect.dll from our side. You have to download the DLL from Apache website. You can also check the compatibility in Apache's website. 

[JakinH]

Thank you @Priyank Shrivastava. There is likely some misunderstanding as to our setup.  CF2023 is deployed on it's own Windows server with the packaged Tomcat it comes with.  There is a separate IIS server in front of it, so for requests for Cold Fusion pages to work, we have installed the isapi_redirect.dll provided by Adobe to the IIS server and setup worker settings for those pages. 

/cfpages*=worker1

However, some pages for the website are not cold fusion and are served by a completely different set of servers that are running Tomcat.  There is another worker setup for pages to be retrieved from the Tomcat server.

/tcpages*=worker2

AJP requests to worker2 fail using any isapi_redirect.dll from Adobe after CF9.

Does that better explain the situation?  

[BKBK]

Well explained, @JakinH . There has indeed been at least one change in isapi_redirect.dll in recent ColdFusion versions. It was a security fix.

There have been related discussions about it in this very forum: https://community.adobe.com/t5/coldfusion-discussions/coldfusion-2021-update-11-new-connector-requir...

Other related blogposts are

https://www.hoyahaxa.com/2023/10/coldfusion-connectors-and-cfadmin.html

https://lists.apache.org/api/plain?thread=275s1mx2t3zhoqyglms9yqglv86c65qm