Help setting up a Java app protected by a Shib SP?

[Peter Schober]

* Bryan Wooten <bryan.wooten at utah.edu> [2021-03-29 18:36]:
> I thought they would be simple http headers, but that is wrong.

The software does allow you to use HTTP Request Headers to (less
effectively and less securely) transport attributes that way but it
doesn't do that by default.

> So doing some reading I need to configure both the SP and Tomcat it
> use AJP?

Works just fine and is fully documented here:
https://wiki.shibboleth.net/confluence/display/SP3/JavaHowTo

> Also there was a thread about tomcat request.getAttributeNames()
> being broken. So maybe we need to do request.getAttribute(“someName”)?

I can't tell you want you need to do because you're not saying what
you want to achieve. For normal protection of an application there
should be no need to iterate over all possible attributes -- the Shib
SP can't even map any possible attributes at all to begin with, it has
to map them by name, which is your upper maximum of what could be
expected on the Java side.

But yes, there have been reports over many years that using
request.getAttributeNames() will not in fact give you all request
attributes (including the SAML attributes sent that way by the Shib SP
you're looking for) even when you do get the value when asking for a
request attribute by name.

> Am I missing some configuration? Or can someone point to some java
> code that uses servlet request object to get attributes from the SP?

To do what specifically? The generic answer to "How do I get
attributes over to Java" is in the documentation referenced above
(which you seem to have found already).

You don't mention how you configured any of the parts here.
And your comment about what "resolvertest" returns at the IDP doesn't
mean anything wrt what the SP ended up recieving for a given subject.
The SP's transaction log would tell you what attributes arrived (and
with how many values) and the SP's shibd.log would tell you about any
attributes the SP ignored for whatever reason (unmapped name, usually).

-peter