Headers no coming back to Apache Shibboleth Service Provider

[Cahill, Charles (GE Appliances)]

updating the subject
________________________________________
From: users [users-bounces at shibboleth.net] on behalf of Cahill, Charles (GE Appliances)
Sent: Monday, November 23, 2015 9:25 PM
To: Shib Users
Subject: RE: SAML Salesforce Reponse coming in Transient Format

Can anyone give me an idea why headers are coming back to my 3rd party SAML 2.0 clients but dont seem to be coming back to my Apache Service Provider configurations.

Here are my Apache configurations to look at:

AttributeMap
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_XMLSchema-2Dinstance&d=CwICAg&c=IV_clAzoPDE253xZdHuilRgztyh_RiV3wUrLrDQYWSI&r=Ay4xjbXoe6YvlvYwTANr9ZsOm6cEXvasE-gwLIuoyN8&m=Lm03XuWTXukCMoKgxC_LKqqG36KaRM84lR7R9DLJEsY&s=vodFYqSjwrE7xF8BpjbEWjw6T7cr9Y2hGGYJ9prdL6E&e= ">
        <Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" id="transient-id"/>
        <Attribute name="cn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="cn"/>
        <Attribute name="firstname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="firstname"/>
        <Attribute name="lastname" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="lastname"/>
        <Attribute name="email" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="email"/>
        <Attribute name="uid" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="uid"/>
</Attributes>

Attributepolicy
<afp:AttributeFilterPolicyGroup
  xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"
  xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"
  xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
  xmlns:afp="urn:mace:shibboleth:2.0:afp"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <afp:AttributeFilterPolicy id="releaseBasicAttributesToAnyone">
  <!--
                <afp:PolicyRequirementRule xsi:type="basic:ANY"/>
    <afp:AttributeRule attributeID="*"> <afp:PermitValueRule xsi:type="ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="transient-id"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
  -->
                <afp:AttributeRule attributeID="uid"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="email"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="cn"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
                <afp:AttributeRule attributeID="firstname"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>

                <afp:AttributeRule attributeID="lastname"> <afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule>
        </afp:AttributeFilterPolicy>
</afp:AttributeFilterPolicyGroup>

httpd.conf
<VirtualHost *:80>

        ProxyPass /Shibboleth.sso !
        ProxyPass / ${APPLICATION_ENDPOINT}
        ProxyPassReverse /Shibboleth.sso !
        ProxyPassReverse / ${APPLICATION_ENDPOINT}
        RequestHeader set cn "%{cn}e"

        RequestHeader set firstname "%{firstname}e"
        RequestHeader set lastname "%{lastname}e"
        RequestHeader set email "%{email}e"
        RequestHeader set uid "%{uid}e"

        <Location /Shibboleth.sso>
          Satisfy Any
          Allow from all
        </Location>

        <Location /NPI/>
                AuthType shibboleth
                ShibRequestSetting requireSession 1
                require valid-user
                ShibUseHeaders On
        </Location>
</VirtualHost>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net