Robust way to access attributes

[Cantor, Scott]

On 9/28/12 9:06 AM, "Kristof Bajnok" <bajnokk at niif.hu> wrote:
>
>I have trouble accessing the IdP entityID (or generally: any attribute)
>in a robust way in PHP.
>AFAIK, PHP collects all headers, environment variables and other stuff
>into $_SERVER array, but depending on whether the code runs on IIS,
>Apache, through headers or environment, the array index can be:
> - Shib-Identity-Provider
> - Shib_Identity_Provider
> - HTTP_SHIB_IDENTITY_PROVIDER
> - HTTP_SHIBIDENTITYPROVIDER

That's mostly a web server or PHP question, with the exception of the
latter, which is just the consequence of avoiding hyphens on IIS because
of their bugs in CGI handling. I documented that in the security advisory
that came out when the safeHeaderNames option was added. If you want the
same names on IIS for built-in headers as on Apache you'd have to turn
that option off.

A more advisable way to do that would be to forget the old built-in
variables and switch to the new Assertion attribute extractor to populate
that data using attribute names you control. You can even do that just on
Apache to populate one called ShibIdentityProvider or whatever, so that
the name on Apache matches the IIS convention. But probably defining your
own for both works best.

There's an option now to turn off the built-in headers to avoid
duplication (turn off exportStdVars).

Apart from that, obviously anything with HTTP_ is a header and the others
are server variables (what Java calls attributes). I hope to eventually
get the SP updated with a new IIS module for IIS 7+ that lets me set
server variables instead of headers, and that would eliminate an extra
source of differences, but for now that's a fairly well understood
difference.

My general answer is that any app should always have a simple include file
of some kind that defines symbolically all of the headers/variables it
uses. That's common sense to me.

Having said that, if you're trying for a fixed set across Apache and IIS,
then you really don't have a lot of options other than:

- use headers only
- either turn off safeHeaderNames or adjust the Apache config to use
unhyphenated names

>Moreover, other web server modules can occasionally add certain prefixes
>to environment variables (or even headers? dunno) before the script gets
>them, like REDIRECT_ or AJP_, and this is where I start to get lost. I
>haven't find any specific documentation about which modules do like this
>and exactly under what circumstances. (If you have one, please share it!)

I think Peter addressed that.

>I'm dubious whether the right solution would be to also check the AJP_
>and the REDIRECT_ prefixed version of the several names above.

Definitely not the former. I'm not as familiar with the latter but I know
it's come up on the list.

> My biggest concern is that by doing this, I'd lose every bit of the
>spoofing protection what Shib could do for me.

Well, anything with AJP_ in it is something that had to be configured
explicitly, so it seems like that's not really a problem. You certainly
shouldn't see that in PHP.

>I might be missing something trivial, so if you have a working code for
>robustly accessing attributes from a CGI script (any language), would
>you mind sharing it?

I think you're just lacking context for why there are differences, which I
hopefully have supplied.

-- Scott