Apache Shib SP and target URL rewrite

[Peter Schober]

* Jan Vilhuber <JVilhuber at absolute.com> [2017-03-09 04:57]:
> Assuming I'm looking at the right thing, I don't see the attributes
> in the header (I have 'ShibUseHeaders On' set). I'm looking with
> chrome's 'inspect' network tab:
> 
> --------
> GET /myapp/interstitial?return=https%3A%2F%2Fdevlocal.absolute.com%2FShibboleth.sso%2FSAML2%2FPOST%3Fhook%3D1%26target%3Dss%253Amem%253A0820e9dba3db9f05d768e40700f231b9748db360b1a4b32c1b436c6ab8f7ea09&target=https%3A%2F%2Fdevlocal.absolute.com%2Fmyapp%2Ffoo.htm HTTP/1.1
> Host: devlocal.absolute.com
> Connection: keep-alive
> Cache-Control: max-age=0
> Upgrade-Insecure-Requests: 1
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Those are HTTP Request Headers sent from your HTTP user agent to your
HTTP server. Shibboleth does not inject its HTTP Request Headers there
(it can't, really) so you'll never see anything that way.
The HTTP request headers set by the SP will be visible "downstream",
i.e., to code running within/behind that web server.

> The assertion that was processed has plenty of attributes, so I was
> really hoping I'd see them here. The endpoint I'm redirecting to
> doesn't actually exist (yet), and I AM aware of the downsides of
> using the HTTP header for attributes.

Will you end up proxying to some other web server, one that cannot be
integrated with any other way? Or was this just a (misguided) attempt
to ease your debugging?
-peter