SP server variables an IIS with Tomcat Connector

[Bobby Lawrence]

I'm spending some time upgrading the SP on an IIS server to the latest version since it was running V2 and using the outdated ISAPI filter.

For the best security, the latest module version defaults to using server variables instead of headers to prevent client spoofing.  This seems to work fine for ASP apps (via System.Web.UI.PageHandlerFactory handler) and PHP apps (via the FastCGI module) but for ColdFusion, this doesn't work.  I just cannot access these server variables.

The docs (https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335257/AttributeAccess) give specific examples of how to access the server variables for ColdFusion but this doesn't seem to work.  Specifically, it states to use the syntax "CGI.Shib-Identity-Provider", but this always results in a ColdFusion error "The value '' cannot be converted to a number." which makes sense because the interpreter see's the dash and assumes that the code is trying to subtract two variables.  However, even something like CGI["Shib-Identity-Provider"] doesn't work....it returns no value.

I cannot determine if this issue is a ColdFusion proper issue or the Tomcat Connector for IIS that CF uses.  I decompiled the coldfusion.runtime.CgiScope class I can see where it would try to resolve the value for some name from request.getAttribute(), but again - I always get no value, even when the SP is protecting the page.  This leads me to believe that it's a Tomcat Connector issue (which is an ISAPI filter - not a module :().  I've read on some other forums that in order to access certain CGI variables in CF fronted by Apache that you need to declare them in mod_jk.conf via the "JkEnvVar" directive.  It doesn't look like the IIS connector has any such option so I cannot try it.

We are running the latest version of ColdFusion (2023) and IIS 10.  Has anyone else gotten this to work or am I stuck having to live with useHeaders=true?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240223/bbca04e9/attachment.htm>