Shibboleth SP Server variables in IIS

user1630508 pgrandsard at
Thu Apr 23 12:58:05 EDT 2020

When upgrading from Shibboleth 2.x to 3.x, the <ISAPI> element defaults to
useVariables=true and useHeaders=false.

This appears broken in ASP/IIS. I have always used Request.ServerVariables
which are secure and not available to HTTP clients.

Setting useHeaders=true allows the attributes to show up again in

Is this a bug or a difference in behavior between IIS and other web servers?
useVariables seems to do nothing.

Sent from:

More information about the users mailing list