Avoiding empty headers for undefined attributes

[Guillaume Rousse]

Le 12/02/2019 à 15:14, Cantor, Scott a écrit :
>> We currently deploy our SPs as authenticating reverse-proxy, which means we
>> have to transmit attribute using HTTP headers.
> 
> That doesn't mean the SP itself needs to use headers, those are independent considerations.
OK, let's try a better formulation: as the SP and the application don't 
live on the same hosts, the only way to pass user attributes between 
hosts relies on HTTP headers. Those headers can be set either from the 
SP itself, or from the web server living on the same host as the SP. Am 
I correct ?

>> Yesterday, I add a test SP behind this proxy
> 
> If the SP is behind the proxy, then the headers would be local to that system, not coming from the proxy, and so you shouldn't need headers at all. "Behind the proxy" generally means "the proxy first, then the SP".
Oops, inconsistent vocbulary of mine: I meant a test *application*, seen 
as a service provider from the outside world.

>> Is there any way currently to either post-process this headers/variables list, and
>> unset all those without value, or even better, change the SP strategy from
>> iterating over known attributes to iterating over received assertions only ?
> 
> The empty headers are a necessary defense against smuggling. Again, don't use headers, problem solved. You don't need them. If the SP is behind the proxy, there should be no headers. If the SP is front of the proxy, then you need to establish a specific whitelisted set of headers from the local server variables set by the SP and then those are the only headers passed back from the proxy.
f I understand correctly, what you're suggesting is to conditionally set 
those headers from the web server (apache), using a set of configuration 
directives such as:

Header set HTTP_EPPN "%{eppn}e" env=eppn
Header set HTTP_MAIL "%{mail}e" env=mail
...

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20190212/35859225/attachment.p7s>