how to access request-attributes ('server variable' / 'environment variables') in servlet

[Woolf, Carl]

TLDR;
I can get IdP attributes in servlet-request-headers, but want to (and cannot) get them as request-attributes.
Any guidance appreciated!

=======================================================================================
On this sp3 page https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335257/AttributeAccess#Server-Variables

it says that the attribute Shib-Identity-Provider was ‘baked into’ the SP.
Later in the Tool-Specific Examples, it gives this servlet example:

request.getAttribute("Shib-Identity-Provider")

In my servlet, when I say

String shibIdProvider = (String) request.getAttribute("Shib-Identity-Provider");
result += "\n\n===============shibIdProvider=====\n" + shibIdProvider;

my logs show:

===============shibIdProvider=====
null

My apache config has


<LocationMatch "/my-stuff/">

  AuthType shibboleth

  ShibRequestSetting requireSession 1

  Require valid-user local

  ShibUseEnvironment On

  ShibUseHeaders On

</LocationMatch>

And my logs show all of the Attributes that my IdP is sending as request-headers.
But I would like the more-secure method of getting them as request-attributes. Currently, my logs show no request-attributes from the SP.

In my shibboleth2.xml, my ApplicationDefaults says

       <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

And that seems to have an effect, since if I change the path to “foo”, I don’t get the request-headers any more.

FWIW, I also tried omitting the ShibUseHeaders line, thinking that perhaps headers / request-attributes were a zero-sum game, i.e. you could only get one or the other. That resulted in my logs showing no headers, and still no request-attributes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220713/3761d670/attachment.htm>