[Solved] Re: ColdFusion and Attribute Access in the SP

[Peter Schober]

* Martin Haase <martin.haase at daasi.de> [2021-07-08 16:52]:
> To make Tomcat accept the SP's attributes, the property
> *allowedRequestAttributesPattern* in Tomcat's configuration must be
> set to a regular expression matching the expected attribute
> names.

Yeah, sorry, I was bitten by that too recently but didn't realise you
were having the same problem from your description. (I misread your
'although "eppn" is visible in the session' to mean you're getting
eppn through to Tomcat.)

Tomcat 9.0.31 from Debian Buster rejects all requests carrying
attributes with the rather generic error message:
  "The server understood the request but refuses to authorize it."
Only once I swapped in Tomcat 9.0.39 (from Buster Backports) did log
messages like these finally appear:
  [warning] Rejecting request due to unknown request attribute [Shib-Handler] received from reverse proxy
  [warning] Rejecting request due to unknown request attribute [Shib-Application-ID] received from reverse proxy
  [warning] Rejecting request due to unknown request attribute [Shib-Session-ID] received from reverse proxy
  [warning] Rejecting request due to unknown request attribute [Shib-Identity-Provider] received from reverse proxy
  etc.

Disabling that "feature" by setting the value to ^.*$ was a quick fix
once the missing log messages made clear what's actually happening.

-peter