Page Comparison

...

• Tomcat: Tomcat has an AJP 1.3 connector enabled by default.
  • Setting the tomcatAuthentication="false" attribute on the AJP <Connector> element allows for passing REMOTE_USER from Apache httpd. See Tomcat's AJP Connector documentation for more.

• Jetty: Jetty's documentation has good instructions on how to enable both Jetty and your application to listen on AJP 1.3.

  Info
  title Jetty 9 drops AJP
  Note that AJP support has been dropped starting from Jetty version 9. They recommend using mod_proxy_http instead of mod_proxy_ajp.

Be careful that there is no direct HTTP listener opened by the servlet container. If, for example, there's an HTTP connector listening on port 8080 and no interceding firewall, users would be able to directly access the servlet on port 8080, which bypasses Apache httpd. This also means they would bypass Shibboleth authentication and authorization.

...