Avoiding empty headers for undefined attributes

[Guillaume Rousse]

Le 12/02/2019 à 18:16, Cantor, Scott a écrit :
>> f I understand correctly, what you're suggesting is to conditionally set those
>> headers from the web server (apache), using a set of configuration directives
>> such as:
> 
> Yes, that's the correct way to proxy headers (in any situation, independent of this specific one). You never proxy all headers as a pass-through, that's insecure on a number of different levels and leads to all sorts of security holes on the back-end.
For the record, if anyone is ever interested by the issue, here are the 
correct configuration for an apache-based setup.

To emulate the same behaviour as the SP itself, ie define an header for 
each mapped attribute, whereas a SAML assertion is found or not, you 
have to add one directive for each attribute and the 7 builtin SP 
variables (Shib-Session-Id, ...), identified as xyz below:
RequestHeader set xyz "%{xyz}e"

To emulate a slightly more efficient behaviour, ie define an header for 
each mapped attribute with a SAML assertion, and remove client-provided 
header for  attributes without assertion, you have to add two 
conditional directives for each attribute and the 7 builtin SP variables 
(Shib-Session-Id, ...), identified as xyz below:
RequestHeader set xyz "%{xyz}e" env=xyz
RequestHeader unset xyz env=!xyz

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20190214/432ce99d/attachment.p7s>