Apache with mod_shib and mod_proxy

[Jack Hill]

Hi,

I'm interested in using mod_shib with Apache to serve applications via 
reverse proxy. I would like the shib SP to be able to pass along 
attributes to the application. The obvious (at last to me) way to do this 
is to pass the attributes via request headers. However, I've read the big 
warnings on 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSpoofChecking 
am reluctant to take that approach, and am interested in doing the work to 
avoid using request headers. Unfortunately, I'm not sure what that work 
is. Is it possible to to use shib in this way with a reverse proxy? If so, 
how? (In particular, I'm interested in reverse proxying Ruby's Puma 
webserver and also Tomcat via ajp://)

Also, I don't think I fully understand the risk of using request headers. 
I understand that these can be set by an untrusted client, but I don't 
know why it is error-prone and risky to scrub the known headers that shib 
sets. Enlightenment on this topic would be appreciated.

Best,
Jack