Rewriting shib headers as proxy request headers: Session ID?

[Christopher Piggott]

I am setting up an Apache 2 proxy with shibboleth.  The service being
proxied to (Odoo) wants the SSO user and a session ID, so I did this:

 

    RequestHeader set Remote-User %{SHIB_mail}e env=SHIB_mail

    RequestHeader set Shib-Session %{SHIB_Shib_Session_ID}e
env=SHIB_Shib_Session_ID

 

Those vars start SHIB_ because my attributePrefix is "SHIB_" (in
shibboleth2.xml).

 

I wrote a small cgi-bin in the same virtual host to make sure those
environment variables are visible.  They are.  And, in fact, I can set lots
of headers based on env vars like SHIB_mail, SHIB_givenName, and others.
But, for some reason SHIB_Shib_Session_ID doesn't work.  Again, I can
confirm that when I wrote this small cgi (snippet of python):

 

    for key, value in os.environ.items():

        print(f"{key}: {value}")

 

that I see SHIB_mail, SHIB_givenName,, and SHIB_Shib_Session_ID.  Yet they
aren't getting rewritten.

 

I made a second attempt using mod_rewrite:

 

    RewriteEngine On

    RewriteCond %{LA-U:SHIB_Shib_Session_ID} (.+)

    RewriteRule . - [E=RU:%1]

    RequestHeader set Shib-Session %{SHIB_Shib_Session_ID}s     # note I
tried %{SHIB_Shib_Session_ID}e here as well but I think it's a server
variable by this point

 

 

That didn't work, either. In the first example (RequestHeader set) the
header is simply not written.  In the second example, it has the value
(null).

 

I feel like the issue has something to do with when the session ID becomes
available, and that for some reason other attributes are set before
"RequestHeader set" but not the session ID.  Could that be the case?  Or
there something magical about SHIB_Session_ID that makes it not visible to a
rewrite rule on a proxy?  (I can't see how that could be, but I don't know
what I don't know).

 

--Chris

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240220/6ef8b949/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7132 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240220/6ef8b949/attachment.p7s>