Shibboleth SP Server variables in IIS

[user1630508]

When upgrading from Shibboleth 2.x to 3.x, the <ISAPI> element defaults to
useVariables=true and useHeaders=false.

This appears broken in ASP/IIS. I have always used Request.ServerVariables
which are secure and not available to HTTP clients.

Setting useHeaders=true allows the attributes to show up again in
Request.ServerVariables.

Is this a bug or a difference in behavior between IIS and other web servers?
useVariables seems to do nothing.



--
Sent from: https://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html