http://shibboleth.net/community/advisories/secadv_20060615.txt On Oct 2, 2013, at 1:24 , Scott Koranda wrote: > Can you provide an example of how a header could transform itself > into, for example, 'eppn' if it is not sent by a malicious client as > 'eppn'?