[Solved] Re: ColdFusion and Attribute Access in the SP

[Martin Haase]

Hi List,

thanks to a hint by Scott via the Consortium's member chat, this could
be resolved: Error 403 is a hint that a newer Tomcat would not accept
the attributes injected by the SP. To make Tomcat accept the SP's
attributes, the property *allowedRequestAttributesPattern* in Tomcat's
configuration must be set to a regular expression matching the expected
attribute names. See
https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html

Hope this helps others,
Martin

Am 07.07.21 um 14:02 schrieb Martin Haase:
> Dear List,
>
> maybe someone in here has already done this. We have installed a current
> SP on Linux with Apache2.4 that proxies via AJP to a Tomcat that runs a
> ColdFusion Application. We have issues with seeing attributes at the
> application. A variable like "CGI.EPPN", "CGI.HTTP_EPPN" etc. would not
> be available for dump although "eppn" is visible in the session, and
> "AJP_eppn" in phpinfo() as well.
>
> We tried both passive and active protection of <Location />, with
> ProxyPass of "/" to ajp://localhost (excluding the Shib Handler URL).
>
> Do you have any idea?
>
> Cheers
>
> Martin
>
> P.S: Maybe this has something to do with it: The application seems to
> require a "Require all granted" in its <Location>. However, when I want
> to use passive protection and say "Require shibboleth", then these two
> directives seem to disturb each other. As soon as I comment the "Require
> all granted", the application would answer with a HTTP 403.
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210708/35d7b673/attachment.htm>