Getting user attributes through reverse proxy?

[Peter Schober]

* B. A. <fugaman at gmail.com> [2016-11-22 15:48]:
> How to get user attributes through reverse proxy? I've got a SP
> setup and can't get the values through envvars afaik because I have
> a reverse proxy up on apache. Does that mean you're supposed to
> enable transmitting them through http headers, which is described as
> very unsafe so I'd rather not.

With more services coming with their own, sometimes embedded, web
servers it seems to become necessary more often recently to deploy
httpd + the shib SP that way.

> I tried sending them through ReqHeaders, but while
>                > RequestHeader set X-Remote-User %{REMOTE_USER}s
> works and the value of the httprequest.header(x-remote-user) is correct,

The recommendation from this forum would probably be to not call this
X-Remote-User, but anything you want (as it is not REMOTE_USER, just
an arbitrarily named HTTP Request Header).

> something like
>                 > RequestHeader set X-cn %{cn}s
> is always valued null, even though I'm getting the cn attribute correctly
> etc, at least in sessio summary I see Attributes cn: 1 value(s).

Unless I'm mistaken that can only happen when you're not protecting
the resource (at the proxy, httpd with shib) and therefore httpd does
not "see" the attributes.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig
If you're not enforcing authorization in httpd config you'll need at
least a dummy rule like this one (cf. wiki page above):
<Location /> # or whatever
  AuthType shibboleth
  Require shibboleth
</Location>

-peter