UID not available in HTTP variables

[Hong Ye]

Hi Scott,

If it is not safe to use headers, does Shibboleth SP set attributes as server variables? I dump all the cgi variables and didn't see any attributes in there.

Thanks,
Hong

On 6/20/19, 8:51 AM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

    On 6/20/19, 8:47 AM, "users on behalf of John Schrader" <users-bounces at shibboleth.net on behalf of John.Schrader at nd.edu> wrote:
    
    > If I understand things correctly re the useHeaders option; it should be used in conjunction with safeHeaderNames=true
    > and you should only use the headers prefixed with "HTTP_"
    
    It's much more involved and open to unknowns than that. There is no safe way to use headers and no reason to do so anymore unless HTTP proxying is involved (which I would never do by choice anyway). Cold Fusion should be able to read CGI variables, and Tomcat can read them from there too via the AJP_ prefix trick, so in the end it's a matter of doing the necessary work.
    
    -- Scott
    
    
    -- 
    For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net