Questions about Shibboleth Attribute Access with modern Webservers

[Scott Cantor]

On Aug 14, 2026, at 10:15 AM, V via users <users at shibboleth.net> wrote:
> 
> I am writing an application for a university project which will use Shibboleth SP for SSO.
> 
> However, the codebase is in Rust (using axum as a webserver), and I currently am rather puzzled about how one would access the attributes provided in the server environment variables after the request has been intercepted by an Apache Instance running Shibboleth SP.

You can't. Environment variables work locally to a web server only.

> 2. In case this is not feasible: What is the current verdict on using HTTP headers instead ? I have read in the Atlassian documentation that by now, this approach has been worked on to make it as secure as possible (employing anti-spoofing techniques as well) but naturally there's always a remaining risk.

That's not relevant. You are not using a web server this software supports, so what Shibboleth does or doesn't do isn't really the point here.

If you choose to deploy a proxy-based architecture to some back end with Apache on the front-end, you are literally dependent on smuggling data into the back-end with headers, that's what proxy architectures do.

That doesn't mean the headers being produced by Apache as a proxy have to come from headers (and they shouldn't). Outbound header creation can generally source from the secure server environment.

-- Scott