Where are the shibd env vars?

[Cantor, Scott]

On 7/13/12 1:08 PM, "Christopher J. Bottaro" <cjbottaro at academicworks.com>
wrote:
>
>I'm basically trying to mimic this:
>http://www.ruby-forum.com/topic/168155 (last post in thread)

That seems like a lot of chewing gum and bailing wire vs. just using an
alternative implementation that is suitable to your environment. I'd be
very concerned about sustainability and security issues in linking
multiple servers together like that.

>So I'm testing with testshib.org and I have it working where going to
>http://mydomain.com/secure redirects to the IDP's login page.  Then after
>a successful login, it redirects back to
>http://mydomain.com/Shibboleth.sso/SAML2/POST.  I have an Apache rewrite
>rule that sends that request to /index.php, which then var_dump($_SERVER).

If you're rewriting a request like that, the SP wouldn't ever have a
chance to do its job, and moreover, unless the SP is told to protect and
annotate requests for /index.php, it's not going to.

The SP has to process the POST and then relies on RelayState or the
homeURL setting to route the request after a session is created. That
resource MUST be covered by the Apache settings required to activate an
authentication module (AuthType and require). That, along with the session
being present, determines what you get.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent

-- Scott