sending environment variables to weblogic

[Richard Frovarp]

On Tue, 2021-03-30 at 23:21 +0000, Richard Frovarp via users wrote:
> On Wed, 2021-03-31 at 00:51 +0200, Peter Schober wrote:
> > * Jerry Shipman <jes59 at cornell.edu> [2021-03-30 21:10]:
> > > It looks like "ShibUseHeaders" might work. But the documentation
> > > I
> > > found (https://wiki.shibboleth.net/confluence/display/SP3/Apache)
> > > says not to use this. But I haven't yet found anything that tells
> > > you what you should do instead.
> > 
> > https://wiki.shibboleth.net/confluence/display/SP3/JavaHowTo
> > 
> > Obviously that requires the application server to support AJP
> > (which
> > Weblogic does not, from a quick web search) in which case you're
> > left
> > with either HTTP proxying or not using the Shibbleth SP at all.
> > 
> > -peter
> 
> HTTP proxying is fine. AJP isn't secure in the least, and is very
> likely to be removed from a future HTTPD version.

And to clarify, AJP is as secure as HTTP proxying, which is to say not
secure. Keeping it all on localhost means you can ignore the on the
wire encryption that you would get from HTTPS.