Where are the shibd env vars?

[Christopher J. Bottaro]

Awesome, with that point in the right direction, I got it working!  

I have two followup questions though…

1)  Can I configure attribute-map.xml to pass through everything (not just explicitly named attributes)?

2)  I current have ShibUseHeaders turned on.  My setup looks like this:  Apache (shibd) -> Nginx -> Unicorn (Rails). Given that, it is possible to just use ShibUseEnvironment instead of ShibUseHeaders?

Thanks for the help.

--  
Christopher J. Bottaro
Sent with Sparrow (http://www.sparrowmailapp.com/?sig)


On Friday, July 13, 2012 at 12:19 PM, Cantor, Scott wrote:

> On 7/13/12 1:08 PM, "Christopher J. Bottaro" <cjbottaro at academicworks.com (mailto:cjbottaro at academicworks.com)>
> wrote:
> >  
> > I'm basically trying to mimic this:
> > http://www.ruby-forum.com/topic/168155 (last post in thread)
> >  
>  
>  
> That seems like a lot of chewing gum and bailing wire vs. just using an
> alternative implementation that is suitable to your environment. I'd be
> very concerned about sustainability and security issues in linking
> multiple servers together like that.
>  
> > So I'm testing with testshib.org (http://testshib.org) and I have it working where going to
> > http://mydomain.com/secure redirects to the IDP's login page. Then after
> > a successful login, it redirects back to
> > http://mydomain.com/Shibboleth.sso/SAML2/POST. I have an Apache rewrite
> > rule that sends that request to /index.php, which then var_dump($_SERVER).
> >  
>  
>  
> If you're rewriting a request like that, the SP wouldn't ever have a
> chance to do its job, and moreover, unless the SP is told to protect and
> annotate requests for /index.php, it's not going to.
>  
> The SP has to process the POST and then relies on RelayState or the
> homeURL setting to route the request after a session is created. That
> resource MUST be covered by the Apache settings required to activate an
> authentication module (AuthType and require). That, along with the session
> being present, determines what you get.
>  
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
>  
> -- Scott
>  
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net (mailto:users-unsubscribe at shibboleth.net)
>  
>  


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120713/bd4fa858/attachment.html