Getting user attributes through reverse proxy?

[B. A.]

How to get user attributes through reverse proxy? I've got a SP setup and
can't get the values through envvars afaik because I have a reverse proxy
up on apache. Does that mean you're supposed to enable transmitting them
through http headers,  which is described as very unsafe so I'd rather not.

I tried sending them through ReqHeaders, but while
               > RequestHeader set X-Remote-User %{REMOTE_USER}s
works and the value of the httprequest.header(x-remote-user) is correct,
something like
                > RequestHeader set X-cn %{cn}s
is always valued null, even though I'm getting the cn attribute correctly
etc, at least in sessio summary I see Attributes cn: 1 value(s).

So, 1. Is that how you're supposed to transmit headers in this setup?
2. Why does apache not see attributes besides remote user?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161122/25756781/attachment.html>