sending environment variables to weblogic

[Nate Klingenstein]

Jerry,

I would read that as "avoid if possible and use only if you know what you're doing" rather than as a stop sign.  There hasn't been a vulnerability related to header spoofing in many years and if you keep the network secured between the SP and the WebLogic container(which it ought to be on the same machine), the additional potential exposure is minimal.

Sometimes there just isn't a more elegant way to ferry things to the back-end listener.

Read through the suggested material, understand the potential exposure, and I'd move ahead.

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Jerry Shipman
Sent: Tuesday, March 30 2021, 1:10 pm
To: users at shibboleth.net
Subject: sending environment variables to weblogic

Hello,
I have a user who has apache with mod_shib in front of a weblogic application server (like a proxy situation, on the same machine). We're trying to figure out how to get the shib attribute information into the weblogic application. I haven't worked with this particular setup before.

It looks like "ShibUseHeaders" might work. But the documentation I found (https://wiki.shibboleth.net/confluence/display/SP3/Apache <https://wiki.shibboleth.net/confluence/display/SP3/Apache>) says not to use this. But I haven't yet found anything that tells you what you should do instead. Can you guys give me some hints here?

Thank you,
Jerry

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg <https://wiki.shibboleth.net/confluence/x/coFAAg>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>