Receiving headers in Shibboleth/SAML

[Cantor, Scott]

There are no headers by default, and you really shouldn't turn them on, the default integration is with server variables, which don't behave the same way.

In a CGI environment, REMOTE_USER is a server variable, as is REMOTE_ADDR, or PATH_INFO.

HTTP_USER_AGENT is a header (a client-driven one, but still).

Headers have to be enabled instead of or in addition to the preferred option. They're more prone to security problems, on IIS especially, and should be avoided outside of proxying scenarios.

Server variables also have the advantage of not requiring special prefixing or translation, the names mapped in from the SP configuration are the actual names of the variables in most cases.

> However, when I look at the header values either in my
> SAML Chrome extension

Even if headers are enabled, if you could see them in Chrome, you would be seeing client-supplied values, and if the SP honored those it should be self-evident why you'd have a serious security problem (as in fact the software has had at times because of the complexities of preventing that, thus the earlier point).

You can't see anything the server adds except within an application on the server reading them.

The SP logs are also useful in determining the result of the mapping process, moreso in a negative sense, as it logs anything it doesn't map in as ignored.

> Do I need to put some value in the attribute-map.xml file?

The file maps from SAML Attribute naming to the names of the variables populated by the SP for applications. What you have to put there depends on what SAML Attribute names you intend to support inbound, beyond the defaults that are in there out of the box, which are largely the LDAP-flavored ones used in research and education.

> I’ve tried reading the documentation but it’s impenetrable to
> somebody who has never dealt with this before. 

Parts of it I would agree, and other parts are written with a lot of presumed domain knowledge and that's by design.  Documenting SAML, web servers, and how headers and variables work was not a goal.

-- Scott