no default shibboleth headers after successful authentication

[Cane Cubtow]

Hey guys I have been trying to figure this one out for a long time and am
hoping someone can identify what I am missing. I am trying to setup shibb
sp on Apache that's in-front of a jboss application. The application is
expecting to see the "Shib-Identity-Provider" header along with some
attributes from the IDP. the problem is that these headers are never
present when the shibb protected path is accessed even though a session is
present. the only shibboleth related header is the "_shibsession_" cookie.

the page that needs to have the headers is:

http://<vhost.fqdn>/app1/singlesignon/SsoShibbolethService

I am using an IDP initiated url to access the site in the following format:

http://<idp_url>?providerid=<entityID_of_Shibb_SP>&returnurl=
<Shibb_protected_Site_that_needs_headers>

this goes to the IDP login page, credentials supplied to login, then gets
redirected to the sp app site that requires the headers, but the shibb
headers are never set...

my configuration is as follows:

/etc/shibboleth/shibboleth2.xml:

    <ApplicationDefaults entityID="http://<vhost.fqdn>/Shibboleth"
                         REMOTE_USER="repid mail"
                         attributePrefix="AJP_">
        <Sessions lifetime="28800"
                  timeout="3600"
                  relayState="ss:mem"
                  checkAddress="false"
                  handlerSSL="false"
                  handlerURL="/Shibboleth.sso"
                  cookieProps="http">
            <Logout>SAML2 Local</Logout>
            <md:AssertionConsumerService Location="/SAML2/POST" index="1"
                Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
            <Handler type="MetadataGenerator" Location="/Metadata"
signing="false"/>
            <Handler type="Status" Location="/Status"/>
            <Handler type="Session" Location="/Session"
showAttributeValues="true"/>
        </Sessions>

/etc/shibboleth/attribute-map.xml (just the repid attribute shown):

 <Attribute id="repid"
 name="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName" />

/etc/httpd/conf/extra/httpd-default.conf:

UseCanonicalName Off
Include /etc/httpd/conf/shib.conf
<LocationMatch "/app1/singlesignon/*" >
  AuthType shibboleth
  ShibCompatWith24 on
  ShibRequestSetting requireSession 1
  ShibUseHeaders on
  require valid-user
</LocationMatch>
Include /etc/httpd/conf/mod_jk.conf

when i access http://<vhost.fqdn>/Shibboleth.sso/Session i get:

*Miscellaneous**Session Expiration (barring inactivity):* 24
minute(s)*Client Address:* 10.10.42.211*SSO Protocol:*
urn:oasis:names:tc:SAML:2.0:protocol*Identity Provider:*
http://<idp_url>:7499/fed/idp*Authentication Time:*
2015-04-24T15:54:16Z*Authentication Context Class:*
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport*Authentication
Context Decl:* (none)
*Attributes**repid*: 50001


but repid and the default shibboleth headers like "Shib-Identity-Provider"
are not present after the redirect to http://<vhost.fqdn
>/app1/singlesignon/SsoShibbolethService

any ideas what i am missing???
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150424/38ba446f/attachment.html>