Trouble getting attributes from Sibboleth into PHP/Tomcat

[Keith Osborne]

Hi,

I believe I have Sibboleth set-up correctly (famous last words), 
hitting:  https://mydomain/Shibboleth.sso/Login redirects to the iDP and 
the login works successfully and redirects me back to https://mydomain/ 
but I want to get access to the extra attributes placed in the SAML 
response.

When I visit https://mydomain/Shibboleth.sso/Session it shows the following:

Miscellaneous
Client Address: <ip>
Identity Provider: urn:federation:XX:stage
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol
Authentication Time: 2013-05-26T10:45:36.528Z
Authentication Context Class: 
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
Authentication Context Decl: (none)
Session Expiration (barring inactivity): 119 minute(s)

Attributes
DisplayName: Fedtest1, Dfw
EmailAddress: dfw.fedtest1 at xx.com
FirstName: Dfw
GeographicUnit: United States
LastName: Fedtest1
enterpriseId: dfw.fedtest1
persistent-id: dfw.fedtest1 at xx.com

I have tried the scripts for both PHP and Tomcat (via mod_jk connector 
and Apache) here: http://shib.kuleuven.be/download/sp/test_scripts/

My main efforts are focussed around a Tomcat application but for now I'd 
settled for getting the values in PHP - it seems Sibboleth/mod_shib 
aren't passing the attributes as headers to Apache?  No HTTP_SHIB 
headers are set so I'm really at a loss at how to get the information 
from the mod_shib session page into an actual application.

This is my configuration:

<Location /Shibboleth.sso>
AuthType shibboleth
  ShibRequireSession On
  ShibUseHeaders On
  require valid-user
</Location>

Debian 6
Apache 2.2
Shibboleth 2.4.3

For now I would appreciate any pointers on the PHP side of things to 
help reduce the problems complexity without introducing Tomcat ....

Keith

-- 
TDR Networks
[ hosting | e-commerce | custom development | linux | cisco ]
e: keith at tdrnetworks.com
t: 02890 286150
m: 07738 734590
w: http://www.tdrnetworks.com