attribute-map.xml changes not visible in apache

[Cantor, Scott]

On 2/3/21, 10:58 AM, "users on behalf of David Balažic" <users-bounces at shibboleth.net on behalf of David.Balazic at comtrade.com> wrote:

>    Where to look?

If the transaction log shows it cached the relevant attribute ID then it's definitely there and would be getting populated. I would probably use a CGI script to dump the Apache environment and verify that it's present on that end. After that, there's nothing else to check.

The reason the rules don't reload, aside from the actual setting that tells it not to reload them, is that headers are insecure and the "this likely only works until it doesn't" trick to clear them out relies on knowing what the possible headers are, so when the rules change, all sides have to be fully in sync to prevent a security hole. Not reloading it prevents things from falling out of sync.

-- Scott