Get Shibboleth environment variables with Python

[James Dore]

On 13 May 2014, at 16:13, Peter Schober <peter.schober at univie.ac.at> wrote:

> * James Dore <james.dore at new.ox.ac.uk> [2014-05-13 16:42]:
>> How do I capture the Shibboleth environment variables with Python?
>> I’ve written a small script that dumps out all the OS variables
>> which Python can see, and it runs immediately after a Shibboleth
>> login. I was expecting to see REMOTE_USER at least, but it does not
>> appear.
> 
> Leave Python out of it at first (same goes for any language/API).
> 
> First check httpd's access log, it will log REMOTE_USER if it is set.

Ah - nothing is logged. 

> Then (assuming there's nothing) look at your shibboleth2.xml where
> you'll find the precedence list of attribute ids (referencing
> attribute-map.xml entries) which will populate REMOTE_USER in order of
> them being set (i.e., having a value).

Is that the <ApplicationDefaults> section? That’s the only place REMOTE_USER appears:

 <ApplicationDefaults entityID="https://gatekeeper.new.ox.ac.uk/shibboleth"
                         REMOTE_USER="eppn persistent-id targeted-id”>

my attribute-map.xml and attribute-policy.xml are unchanged from default. 

> To see what the IDP sent (presumably none of the attributs currently
> tried for REMOTE_USER) check the Shib SP's transaction.log
> Possibly the IDP did not send any of those attributes so REMOTE_USER
> is empty.

Transaction.log contains sections such as:

2014-05-14 14:30:26 INFO Shibboleth-TRANSACTION [10]: New session (ID: _dde9f2a9194b874591007cb1cc2b1385) with (applicationId: default) for principal from (IdP: https://registry.shibboleth.ox.ac.uk/idp) at (ClientAddress: 129.67.108.114) with (NameIdentifier: _7bcfea7444bd8f057218b399581318cf) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _c9e840ff0e48ca99564af309007fc705)
2014-05-14 14:30:26 INFO Shibboleth-TRANSACTION [10]: Cached the following attributes with session (ID: _dde9f2a9194b874591007cb1cc2b1385) for (applicationId: default) {
2014-05-14 14:30:26 INFO Shibboleth-TRANSACTION [10]: 	affiliation (1 values)
2014-05-14 14:30:26 INFO Shibboleth-TRANSACTION [10]: 	eppn (1 values)
2014-05-14 14:30:26 INFO Shibboleth-TRANSACTION [10]: 	persistent-id (1 values)
2014-05-14 14:30:26 INFO Shibboleth-TRANSACTION [10]: }

> 
>> Am I considering the correct environment variables? Do I need to do
>> something within the shibd config to enable it?
> 
> You can point your code at any envvar you want, but REMOTE_USER is OK
> and also allows you to iterate over several candidate attributes
> without writing your own code for that. On-the-wire attribute names
> are already abstracted in attribute-map.xml, so you could also change
> mappings there.
> 
> As for Python and accessing REMOTE_USER, it depends on how you're
> integrating with the webserver. E.g. for WSGI there are different
> methods (e.g. request.environ in Flask/Werkzeug) than for CGI
> (os.environ).

I am attempting to use WSGI. Werkzeug appears to be another missing piece of my jigsaw, thanks!


> And of course any envvars (and REMOTE_USER) will only be visible in
> the same process, i.e., if you're running one of the "embedded" Python
> webservers and merely proxying to that from httpd you'll have to use
> HTTP request headers, not envvars, and hence you won't get REMOTE_USER
> directly.
> -peter

Being a novice, my googling brought a few warnings about the relative insecurity of using http headers. Is this a practical security issue, or one that is theoretically exploitable but requires a lot of effort? 

Many thanks,
James