Where are the shibd env vars?

[Cantor, Scott]

On 7/13/12 4:01 PM, "Christopher J. Bottaro" <cjbottaro at academicworks.com>
wrote:
>
>1)  Can I configure attribute-map.xml to pass through everything (not
>just explicitly named attributes)?

No, other than obtaining the assertion itself.

>2)  I current have ShibUseHeaders turned on.  My setup looks like this:
>Apache (shibd) -> Nginx -> Unicorn (Rails). Given that, it is possible to
>just use ShibUseEnvironment instead of ShibUseHeaders?

I don't know what those arrows represent. Using headers requires that you
have absolutely total control over the access path with no clients able to
access anything but Apache. There's no chance of securing it otherwise
unless you're deploying a second SSO protocol and gatewaying through.

There's no way in general to proxy things without headers, because
environment variables are by definition set only by locally resident code
in a web server, or have to be tunnelled using custom proxy protocols like
AJP.

-- Scott