Missing Shibboleth attributes in $_Server

[Peter Schober]

* MARTINEZ, ARIEL <AMARTINEZ at hostos.cuny.edu> [2020-09-19 05:28]:
> I went down to basics just cutting out the application for now and
> trying to get the  /secure directory to work. But I get an
> Unauthorized message and it does not redirect to my idp.

That suggests a web server misconfiguration as a working/correct
configuration snippet should have been installed by default, cf.:
https://git.shibboleth.net/view/?p=cpp-sp.git;a=blob;f=configs/apache24.config.in;hb=HEAD
or for the old Apache httpd 2.2:
https://git.shibboleth.net/view/?p=cpp-sp.git;a=blob;f=configs/apache22.config.in;hb=HEAD

So you should start providing specific details about your deployment:

* OS and version
* web server and version
* Shib SP vesion, and how exactly you installed the SP:
  * via YUM and using what repo exactly
  * from downloaded RPMs
  * from re-built SRPMs and for what web server version
  * compiled from source
* What you did to configure it in your server, including relevant
  config snippets
* How exactly you tested that no attributes are available
  (You reference "$_Server" in the subject of this email, which
  doesn't mean anything to me. In case you're meant the PHP
  super-global variable that's called "$_SERVER".)
  * E.g.: what happens if you first establish a session by going to
    /Shibboleth.sso/Login and then right after that access /secure ?
    (or both in one go via /Shibboleth.sso/Login?target=/secure )

> Manually browsing to Shibboleth.sso\Login works to authenticate but no shibboleth variables.

This (accessing /Shibboleth.sso/Login) just initiates a
session. *Where* the variables would be visible (at what REQUEST_URI)
depends on your server configuration:

Unless you added a request parameter (e.g. target=URL) to
/Shibboleth.sso/Login when initiating a session or alternatively
hard-coded a 'homeURL' value in your shibboleth2.xml configuration you
will end up at your web server's root (/) URL after returning from the
IDP with a SAML Assertion.
Since the root URL of your server is not by default protected by the
Shibboleth SP (see above config snippets) you'd NOT see any attributes
there.
I.e., without additional configuration you will NOT see any attributes
by simply accessing /Shibboleth.sso/Login and following all the
redirects to a non-protected web server resource.

-peter