Apache Shib SP and target URL rewrite

[Jan Vilhuber]

> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
> Sent: Thursday, March 9, 2017 3:48 PM
> To: users at shibboleth.net
> Subject: Re: Apache Shib SP and target URL rewrite
> 
> * Jan Vilhuber <JVilhuber at absolute.com> [2017-03-09 04:57]:
> > Assuming I'm looking at the right thing, I don't see the attributes in
> > the header (I have 'ShibUseHeaders On' set). I'm looking with chrome's
> > 'inspect' network tab:
> >
> > --------
> > GET
> > /myapp/interstitial?return=https%3A%2F%2Fdevlocal.absolute.com%2FShibb
> >
> oleth.sso%2FSAML2%2FPOST%3Fhook%3D1%26target%3Dss%253Amem%253A
> 0820e9db
> >
> a3db9f05d768e40700f231b9748db360b1a4b32c1b436c6ab8f7ea09&target=htt
> ps%
> > 3A%2F%2Fdevlocal.absolute.com%2Fmyapp%2Ffoo.htm HTTP/1.1
> > Host: devlocal.absolute.com
> > Connection: keep-alive
> > Cache-Control: max-age=0
> > Upgrade-Insecure-Requests: 1
> > User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
> > AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87
> > Safari/537.36
> 
> Those are HTTP Request Headers sent from your HTTP user agent to your HTTP
> server. Shibboleth does not inject its HTTP Request Headers there (it can't,
> really) so you'll never see anything that way.

[JV:] Oh. Right. Doh. This is via redirection, not internally.

> The HTTP request headers set by the SP will be visible "downstream", i.e., to
> code running within/behind that web server.
> 
> > The assertion that was processed has plenty of attributes, so I was
> > really hoping I'd see them here. The endpoint I'm redirecting to
> > doesn't actually exist (yet), and I AM aware of the downsides of using
> > the HTTP header for attributes.
> 
> Will you end up proxying to some other web server, one that cannot be
> integrated with any other way? Or was this just a (misguided) attempt to ease
> your debugging?

[JV:] Both, I guess :) Hm. So how can I get the assertion (or at least attributes from the assertion) down to my webapp? Is there an 'internal session hook'? I looked at various assertion export options and none were all that great :-/ It's entirely plausible I add some local cgi script that looks at cgi environment variable and somehow passes that on to an external service, but that still leaves me wondering which internal call I can use for that. I'll go back to the docs and read some more, but if you have advice, I'd much appreciate it (and I appreciate it so far; boy do I feel dumb now that I missed this was a redirection, not an internal call).

Jan



> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net