Use Shibboleth environments variables in mod_proxy_http

[Cantor, Scott]

On 8/6/13 4:18 AM, "ranadeep_h" <ranadeep_h at infosys.com> wrote:

>Thanks for the prompt response. Just to be sure of what we are trying to
>convey, I am furnishing our current configurations (working / non-working
>scenarios). /*We would like to get your opinion on the best solution*/ as
>our backend application demands usage of "/*mod_proxy_http*/".

That doesn't make any sense. Using HTTP proxying makes application
correctness much harder to achieve, along with all the other drawbacks.

>Have we missed any settings? If not, is retrieval of shibboleth attributes
>(along with REMOTE_USER) via headers the only option for the backend
>application ?

Yes, and it has nothing to do with Shibboleth. This is how HTTP proxying
works.

You should not be proxying HTTP. Your application should *not* require
that, and I've never seen one that did. I have seen incompetent people
force others to deploy things that way because of a misguided impression
that it's more "secure", which is also nonsense. So if you're in that
situation, you have my condolences, but you should push back if possible.

-- Scott