Avoiding empty headers for undefined attributes

[Cantor, Scott]

> We currently deploy our SPs as authenticating reverse-proxy, which means we
> have to transmit attribute using HTTP headers.

That doesn't mean the SP itself needs to use headers, those are independent considerations.

> Yesterday, I add a test SP behind this proxy

If the SP is behind the proxy, then the headers would be local to that system, not coming from the proxy, and so you shouldn't need headers at all. "Behind the proxy" generally means "the proxy first, then the SP".

> It appears the SP actually export an HTTP header for each mapped attribute,
> and eventually define a value for it if a matching SAML assertion is found. I
> guess that's true also when using environment variables, but I didn't checked.

It's not true.

> Is there any way currently to either post-process this headers/variables list, and
> unset all those without value, or even better, change the SP strategy from
> iterating over known attributes to iterating over received assertions only ?

The empty headers are a necessary defense against smuggling. Again, don't use headers, problem solved. You don't need them. If the SP is behind the proxy, there should be no headers. If the SP is front of the proxy, then you need to establish a specific whitelisted set of headers from the local server variables set by the SP and then those are the only headers passed back from the proxy.

-- Scott