Why doesn't Java's request.getAttributeNames() show Shibboleth attributes?

[Etienne Dysli-Metref]

On 19/06/15 22:53, Michael A Grady wrote:
> The same is true in Tomcat, they don't get listed in the enumeration 
> of the list, but they are there if you explicitly call them. Not sure
> what the reason is for that behavior. Sure does seem like a bug. And,
> to get REMOTE_USER thru the getRemoteUser(), you may need to 
> configure 'tomcatAuthentication="false"' on the AJP connector (or the
> Glassfish equivalent).

This "bug" has already been reported against Tomcat 6 [1] and "fixed" by
amending the documentation. There is some explanation of it in a SO
question [2] but the main point is, from [1]:

> I looked at just including all the Tomcat internal attributes in the
> return from getAttributeNames() but this causes problems with the 
> Servlet 2.5 TCK tests which expect that getAttributeNames() return 
> only those attributes that have been set via setAttribute().

So apparently, one can't fix this without breaking the Servlet
Technology Compatibility Kit, at least version 2.5. This behaviour is
now documented in the Apache Tomcat Connector Reference Guide [3] under
"JkEnvVar":

> You can retrieve the variables on Tomcat as request attributes via 
> request.getAttribute(attributeName). Note that the variables send
> via JkEnvVar will not be listed in request.getAttributeNames().

By reading that guide one would think it only concerns mod_jk, but this
also seems to apply to mod_proxy_ajp...

  Etienne

[1] https://bz.apache.org/bugzilla/show_bug.cgi?id=47364
[2]
http://stackoverflow.com/questions/7338346/why-does-servletrequest-getattribute-have-different-attributes-then-getattribu
[3] http://tomcat.apache.org/connectors-doc/reference/apache.html

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20150622/24773d9c/attachment.sig>