Getting access to Shib Attributes after initial authentication

[Guy Tadi]

Thanks for the response. The Cookies path defaulting to path=/ is OK
because that's where my application resides (in fact, I explicitly set the
cookieProp in the shib config to path=/). However, I can't require
Shibsession for / due to legacy constraints. I agree that Shib SP doesn't
see the request to / because nothing tells the webserver to require SP for
/ which is exactly how I want it. However, by inpsection I determined that
HTTP_COOKIE=_shibsession_randomstring=SHIB_SESSION_ID and so was hoping to
use the SHIB_SESSION_ID to get attributes previously exported to the
session cache during the initial access to /secure. Is that possible?

On Fri, Apr 17, 2015 at 11:37 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Guy Tadi <tadiguy812 at gmail.com> [2015-04-17 17:12]:
> > The approach I'm considering now is to force sessions that require Shib
> > authentication to /secure as defined in RequestMapper "<Path
> name="secure"
> > When the browser hits /secure it establishes a Shib session and I can
> > see all the Shib session attributes. One subsequent access to the
> > application path (which is not in /secure) I'd like to get access to the
> > Shib attributes but all I see is the session cookie which is
> > understandable.
>
> cookieProps defaults to setting HTTP Cookies with a path=/ so it's not
> about the cookie, but that the Shib SP doesn't "see" the request when
> nothing tells the websever that it should involve the SP. E.g. for
> httpd adding this would do it. Check the docs for others:
> <Location />
>   AuthType shibboleth
>   Require shibboleth
> </Location>
>
> > As expected the attributes are no longer in that particular session
> > environment since the access is not to /secure, but the
> > SHIB_SESSION_ID is.
>
> That's not expected, only a slight misconfiguration of your system.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150417/9d2b1c33/attachment.html