Getting access to Shib Attributes after initial authentication

[Peter Schober]

* Guy Tadi <tadiguy812 at gmail.com> [2015-04-17 17:12]:
> The approach I'm considering now is to force sessions that require Shib
> authentication to /secure as defined in RequestMapper "<Path name="secure"
> When the browser hits /secure it establishes a Shib session and I can
> see all the Shib session attributes. One subsequent access to the
> application path (which is not in /secure) I'd like to get access to the
> Shib attributes but all I see is the session cookie which is
> understandable.

cookieProps defaults to setting HTTP Cookies with a path=/ so it's not
about the cookie, but that the Shib SP doesn't "see" the request when
nothing tells the websever that it should involve the SP. E.g. for
httpd adding this would do it. Check the docs for others:
<Location />
  AuthType shibboleth
  Require shibboleth
</Location>

> As expected the attributes are no longer in that particular session
> environment since the access is not to /secure, but the
> SHIB_SESSION_ID is.

That's not expected, only a slight misconfiguration of your system.
-peter