UID not available in HTTP variables

[John Schrader]

There are a lot of parts involved here:
"Load Balancer" --> IIS [ ShibNative --> isapi_redirect ] --> tomcat via AJP

With the following config I believe the server variables are being passed
through the isapi_redirect and process correctly by Tomcat.

<InProcess>
        <ISAPI normalizeRequest="true" safeHeaderNames="true">
        .....
</InProcess>

    <ApplicationDefaults entityID="
https://some-test-host.x.edu/cf-test/shibboleth"
        REMOTE_USER="eppn subject-id pairwise-id persistent-id"

cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"
        attributePrefix="HTTP_">

^specified "HTTP_" as the attributePrefix because it appears that the
isapi_redirect does not honor "AJP_".

The variables are then accessible as:

CGI.FirstName
CGI.eppn
etc ..

Is this a more reasonable / secure / safe configuration for this particular
environment ?

Thanks!
-John S





On Thu, Jun 20, 2019 at 9:27 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/20/19, 9:23 AM, "Hong Ye" <hy93 at cornell.edu> wrote:
>
> > If it is not safe to use headers, does Shibboleth SP set attributes as
> server variables?
>
> Yep. In IIS also.
>
> > I dump all the cgi variables and
> > didn't see any attributes in there.
>
> There is no reliable way to do that in most newer software because they
> build the list of variables in unreliable ways, but even if there was, that
> would mean the system isn't configured correctly. Without directly
> accessing a variable, you can't really know whether it's there or not.
> Dumping variable lists is a nice debugging tool but it is big time insecure
> to do that, so in some ways it's a good thing it no longer works well.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
John Schrader
Identity and Access Management
Office of Information Technologies
University of Notre Dame

EVERYTHING SHOULD BE MADE AS SIMPLE AS POSSIBLE, BUT NOT ANY SIMPLER
—ALBERT EINSTEIN
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190621/2d677f74/attachment.html>