Why doesn't Java's request.getAttributeNames() show Shibboleth attributes?

[Cantor, Scott]

On 6/19/15, 3:36 PM, "users on behalf of Philip Durbin" <users-bounces at shibboleth.net on behalf of philip_durbin at harvard.edu> wrote:

>In a Java app communicating with a Shibboleth SP over AJP I'm trying
>to iterate over HttpServletRequest attributes to print them out but
>the Shibboleth-related attributes are not being printed. Here's the
>code:

Those aren't headers, are you configuring things to get the data passed over as attributes (with the AJP- prefix)?

>Is this some sort of security measure? Or is the getAttributeNames()
>method buggy on my application server? I'm using Glassfish 4.1.

Ultimately it's up to Glassfish, not us.

>p.s. It works just fine, by the way, to print attributes that I look
>up one by one with this:
>
>request.getAttribute("Shib-Identity-Provider")

I guess that answers the first question. I would say that Glassfish has a bug if that's the case.

-- Scott