Shibboleth SP Server variables in IIS

Cantor, Scott cantor.2 at
Thu Apr 23 15:47:16 EDT 2020

On 4/23/20, 3:38 PM, "users on behalf of user1630508" <users-bounces at on behalf of pgrandsard at> wrote:

> attributePrefix="HTTP_" in <ApplicationDefaults> along with
> useVariables="true" useHeaders="false" does indeed work.

That is an interestingly plausible way of possibly maintaining the use of old code while leaving headers left off.

> So there's a strange bug somewhere.

No, there isn't. Prefixing the names *and* turning headers on is going to...yes...prefix the name and then slap HTTP_ on the front of it.

If you want it to just work in the intended way, use the names that are already there without munging, such as "Shib-Identity-Provider" (*).  If you want existing code to work, and not change it, then you'd have to do something else. This is documented as part of the IIS changes made when the release was done.

-- Scott

(*) The collapsing of the hyphens is something that I think only applies to use of headers. That is the safeHeaderNames option. It should not be happening when useHeaders is false, as documented. That *might* be a bug if it's happening anyway.

More information about the users mailing list