UID not available in HTTP variables

[Cantor, Scott]

On 6/21/19, 8:14 AM, "users on behalf of John Schrader" <users-bounces at shibboleth.net on behalf of John.Schrader at nd.edu> wrote:

^specified "HTTP_" as the attributePrefix because it appears that the isapi_redirect does not honor "AJP_".

I can't imagine it wouldn't hand off all the variables to the JK protocol layer just like Apache does, but if it doesn't, then that should disqualify using IIS with it. Apache will pass all the AJP_ variables across to get them populated as request attributes in Java, no headers needed.

> The variables are then accessible as:

Cold Fusion used to do auto-resolution of variables in very questionable ways that were very dangerous with some variables, particularly REMOTE_USER; it made smuggling data very hard to stop. When you can access something that shouldn't be coming from a header with the same name as if it were a header, that's a recipe for a bug.
 
-- Scott