Apache not picking up Shibboleth session variables

[Cantor, Scott]

> ...which would appear to indicate that a session is being created and the
> values I need are being saved.

It does, yes. You should also see them at /Shibboleth.sso/Session (and you should check that to make sure that the session's not being created but then invalidated somehow).

> Anyone know what to do about this issue?  If there are any logs and/or
> configuration files that would be useful for this, please let me know and I'll
> put them on pastebin.

If it's Apache alone, then the only real possibility is that the use of the SP is being invoked in some manual way (by redirecting to /Shibboleth.sso/Login) but the actual resource isn't protected at all. It depends how this is all being used. The resource(s) being protected have to have at least an AuthType of shibboleth and a require rule (if need be a dummy rule of "require shibboleth") for the SP to be doing anything.

Whether they're in headers or environment variables is configuration dependent.

If this isn't just Apache in the flow of things, then the problem is just as likely to be related to however things are connected up behind the scenes and isn't really anything we can diagnose. The module runs in Apache and it will publish the data to the Apache request, but getting it after that is application dependent.

-- Scott