FW: Programmatic Access to SP Attributes

[Chanda Banda]

Thank you all for your responses.

When I list out all my server variables I dont see anything that corresponds
to the Attributes. Im on IIS.

I see keys as below but the values are not the values that were passed back
to me by UKFED:

ALL_HTTP HTTP_CACHE_CONTROL
ALL_RAW
APPL_MD_PATH
APPL_PHYSICAL_PATH
AUTH_PASSWORD
AUTH_TYPE
AUTH_USER
CERT_COOKIE
CERT_FLAGS
CERT_ISSUER
CERT_KEYSIZE 256
CERT_SECRETKEYSIZE 2048
CERT_SERIALNUMBER
CERT_SERVER_ISSUER
CERT_SERVER_SUBJECT
CERT_SUBJECT
CONTENT_LENGTH
CONTENT_TYPE
GATEWAY_INTERFACE
HTTPS
HTTPS_KEYSIZE
HTTPS_SECRETKEYSIZE
HTTPS_SERVER_ISSUER
HTTPS_SERVER_SUBJECT
INSTANCE_ID
INSTANCE_META_PATH
LOCAL_ADDR
LOGON_USER
PATH_INFO
PATH_TRANSLATED
QUERY_STRING
REMOTE_ADDR
REMOTE_HOST
REMOTE_USER
REQUEST_METHOD GET
SCRIPT_NAME
SERVER_NAME
SERVER_PORT
SERVER_PORT_SECURE
SERVER_PROTOCOL
SERVER_SOFTWARE
URL
HTTP_CACHE_CONTROL
HTTP_CONNECTION
HTTP_ACCEPT
HTTP_ACCEPT_ENCODING
HTTP_ACCEPT_LANGUAGE
HTTP_COOKIE
HTTP_HOST
HTTP_REFERER
HTTP_USER_AGENT
HTTP_DNT
HTTP_SHIBSPOOFCHECK


On Mon, Jan 29, 2018 at 10:00 PM, Alexander F. French <
Alexander.F.French at dartmouth.edu> wrote:

> Chanda, I hope my response was helpful to you!
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
> Scott
> Sent: Monday, January 29, 2018 4:33 PM
> To: Shib Users <users at shibboleth.net>
> Subject: RE: Programmatic Access to SP Attributes
>
> > In .NET your attributes will be available as Server Variables:
> >       Request.ServerVariables.GetValues("HTTP_BLAH");
> >
> > Attributes will *not* be available in the Request Headers:
> >       //bad
> >       Request.Headers.GetValues("HTTP_BLAH"); // won't exist
> >       //bad
> >       //you will find
> >       Request.Headers.GetValues("BLAH");      //don't use this!  It's
> coming
> > from the user's browser and shouldn't be trusted!
> >       //bad
>
> I don't know what distinctions you're trying to draw but:
>
> a) The only way the ISAPI module (NOT the beta of the IIS7 module) makes
> the data available is in request headers, and
>
> b) they are not from the browser, they have to be sanitized and protected
> by the SP by clearing them and detecting attempts to spoof them, which the
> module does.
>
> They are in headers. Period. The native module changes that, allowing for
> either case.
>
> What the APIs do and what they seem to be called is immaterial, it's a
> mess of conflicting names and weird problems that is covered at some length
> in the wiki since some of them are inherently risky.
>
> -- Scott
>
> --
> For Consortium Member technical support, see https://na01.safelinks.
> protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.
> net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CAlexander.F.
> French%40dartmouth.edu%7Ce4d30a0b666f4ea9f96f08d5675fed4f%
> 7C995b093648d640e5a31ebf689ec9446f%7C0%7C0%7C636528584059351048&sdata=
> H40wzVggsHQaInTs4J8wAzVOBjyJpwm6l5ueMnRobRc%3D&reserved=0
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180129/4f4a3763/attachment.html>