Apache Shib SP and target URL rewrite

[Peter Schober]

* Jan Vilhuber <JVilhuber at absolute.com> [2017-03-09 11:33]:
> So how can I get the assertion (or at least attributes from the
> assertion) down to my webapp?

Concentrate on attributes first. (To get at the assertion there's a
different method provided, involving a simple request protocol, but
that presupposes you can already read environment variables / request
headers set by the webserver, so you might as well use that to get at
attributes.)

> It's entirely plausible I add some local cgi script that looks at
> cgi environment variable and somehow passes that on to an external
> service

I've tried to answer all of that before, but what do you mean with
passing things on to an external service, specifically? Unless the
webserver with the Shib SP is acting as a reverse proxy to your
"external resource" (i.e., no direct access is possible to the
resource, but *only* through the proxy) that's likely insecure or
requires a(nother) SSO protocol, or both. Cf.
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPOneMany

-peter