Avoiding empty headers for undefined attributes

[Guillaume Rousse]

Hello list.

We currently deploy our SPs as authenticating reverse-proxy, which means 
we have to transmit attribute using HTTP headers.

Yesterday, I add a test SP behind this proxy, and extended the set of 
mapped attributes to all available attributes in our federation, 
approximatively 100. And the result was immediate: too many headers for 
the proxyfied application (The number of request header fields exceeds 
this server's limit).

It appears the SP actually export an HTTP header for each mapped 
attribute, and eventually define a value for it if a matching SAML 
assertion is found. I guess that's true also when using environment 
variables, but I didn't checked. Is there any way currently to either 
post-process this headers/variables list, and unset all those without 
value, or even better, change the SP strategy from iterating over known 
attributes to iterating over received assertions only ?

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20190212/6bf70a1a/attachment.p7s>