Why doesn't Java's request.getAttributeNames() show Shibboleth attributes?

[Philip Durbin]

Hello!

In a Java app communicating with a Shibboleth SP over AJP I'm trying
to iterate over HttpServletRequest attributes to print them out but
the Shibboleth-related attributes are not being printed. Here's the
code:

Enumeration attrs =  request.getAttributeNames();
while(attrs.hasMoreElements()) {
    System.out.println(attrs.nextElement());
}

The attributes I *do* see have nothing to do with Shibboleth. They are
things such as:

- javax.servlet.request.key_size
- javax.servlet.request.ssl_session_id
- javax.servlet.request.cipher_suite
- etc.

Another way this question has been asked (not by me) is "Why does the
iteration not show Shib-Identity-Provider as an available attribute?"
at http://stackoverflow.com/questions/30193117/iterate-through-all-servletrequest-attributes

Is this some sort of security measure? Or is the getAttributeNames()
method buggy on my application server? I'm using Glassfish 4.1.

Thanks,

Phil

p.s. It works just fine, by the way, to print attributes that I look
up one by one with this:

request.getAttribute("Shib-Identity-Provider")

-- 
Philip Durbin
Software Developer for http://dataverse.org
http://www.iq.harvard.edu/people/philip-durbin