Robust way to access attributes

[Kristof Bajnok]

Hi,

I have trouble accessing the IdP entityID (or generally: any attribute)
in a robust way in PHP.
AFAIK, PHP collects all headers, environment variables and other stuff
into $_SERVER array, but depending on whether the code runs on IIS,
Apache, through headers or environment, the array index can be:
 - Shib-Identity-Provider
 - Shib_Identity_Provider
 - HTTP_SHIB_IDENTITY_PROVIDER
 - HTTP_SHIBIDENTITYPROVIDER

(Unfortunately the above list is rather empirical and I don't have notes
on why each one was necessary.)

Moreover, other web server modules can occasionally add certain prefixes
to environment variables (or even headers? dunno) before the script gets
them, like REDIRECT_ or AJP_, and this is where I start to get lost. I
haven't find any specific documentation about which modules do like this
and exactly under what circumstances. (If you have one, please share it!)

I'm dubious whether the right solution would be to also check the AJP_
and the REDIRECT_ prefixed version of the several names above. My
biggest concern is that by doing this, I'd lose every bit of the
spoofing protection what Shib could do for me.

I might be missing something trivial, so if you have a working code for
robustly accessing attributes from a CGI script (any language), would
you mind sharing it?

Thanks,
Kristof