<div dir="ltr"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Thank you all for your responses.</span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">When I list out all my server variables I dont see anything that corresponds</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">to the Attributes. Im on IIS.</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">I see keys as below but the values are not the values that were passed back to me by UKFED:</div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial"><div>ALL_HTTP HTTP_CACHE_CONTROL</div><div>ALL_RAW</div><div>APPL_MD_PATH</div><div>APPL_PHYSICAL_PATH</div><div>AUTH_PASSWORD </div><div>AUTH_TYPE </div><div>AUTH_USER </div><div>CERT_COOKIE </div><div>CERT_FLAGS </div><div>CERT_ISSUER </div><div>CERT_KEYSIZE 256</div><div>CERT_SECRETKEYSIZE 2048</div><div>CERT_SERIALNUMBER </div><div>CERT_SERVER_ISSUER</div><div>CERT_SERVER_SUBJECT</div><div>CERT_SUBJECT </div><div>CONTENT_LENGTH</div><div>CONTENT_TYPE <br></div><div>GATEWAY_INTERFACE<br></div><div>HTTPS<br></div><div>HTTPS_KEYSIZE<br></div><div>HTTPS_SECRETKEYSIZE</div><div>HTTPS_SERVER_ISSUER</div><div>HTTPS_SERVER_SUBJECT</div><div>INSTANCE_ID</div><div>INSTANCE_META_PATH</div><div>LOCAL_ADDR<br></div><div>LOGON_USER <br></div><div>PATH_INFO<br></div><div>PATH_TRANSLATED<br></div><div>QUERY_STRING <br></div><div>REMOTE_ADDR<br></div><div>REMOTE_HOST</div><div>REMOTE_USER </div><div>REQUEST_METHOD GET<br></div><div>SCRIPT_NAME</div><div>SERVER_NAME</div><div>SERVER_PORT</div><div>SERVER_PORT_SECURE</div><div>SERVER_PROTOCOL</div><div>SERVER_SOFTWARE</div><div>URL</div><div>HTTP_CACHE_CONTROL</div><div>HTTP_CONNECTION<br></div><div>HTTP_ACCEPT <br></div><div>HTTP_ACCEPT_ENCODING <br></div><div>HTTP_ACCEPT_LANGUAGE<br></div><div>HTTP_COOKIE <br></div><div>HTTP_HOST </div><div>HTTP_REFERER<br></div><div>HTTP_USER_AGENT <br></div><div>HTTP_DNT<br></div><div>HTTP_SHIBSPOOFCHECK</div></div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 29, 2018 at 10:00 PM, Alexander F. French <span dir="ltr"><<a href="mailto:Alexander.F.French@dartmouth.edu" target="_blank">Alexander.F.French@dartmouth.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Chanda, I hope my response was helpful to you!<br>
<br>
-----Original Message-----<br>
From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a>] On Behalf Of Cantor, Scott<br>
Sent: Monday, January 29, 2018 4:33 PM<br>
To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
Subject: RE: Programmatic Access to SP Attributes<br>
<br>
> In .NET your attributes will be available as Server Variables:<br>
>       Request.ServerVariables.<wbr>GetValues("HTTP_BLAH");<br>
><br>
> Attributes will *not* be available in the Request Headers:<br>
>       //bad<br>
>       Request.Headers.GetValues("<wbr>HTTP_BLAH"); // won't exist<br>
>       //bad<br>
>       //you will find<br>
>       Request.Headers.GetValues("<wbr>BLAH");      //don't use this!  It's coming<br>
> from the user's browser and shouldn't be trusted!<br>
>       //bad<br>
<br>
I don't know what distinctions you're trying to draw but:<br>
<br>
a) The only way the ISAPI module (NOT the beta of the IIS7 module) makes the data available is in request headers, and<br>
<br>
b) they are not from the browser, they have to be sanitized and protected by the SP by clearing them and detecting attempts to spoof them, which the module does.<br>
<br>
They are in headers. Period. The native module changes that, allowing for either case.<br>
<br>
What the APIs do and what they seem to be called is immaterial, it's a mess of conflicting names and weird problems that is covered at some length in the wiki since some of them are inherently risky.<br>
<br>
-- Scott<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
For Consortium Member technical support, see <a href="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CAlexander.F.French%40dartmouth.edu%7Ce4d30a0b666f4ea9f96f08d5675fed4f%7C995b093648d640e5a31ebf689ec9446f%7C0%7C0%7C636528584059351048&sdata=H40wzVggsHQaInTs4J8wAzVOBjyJpwm6l5ueMnRobRc%3D&reserved=0" rel="noreferrer" target="_blank">https://na01.safelinks.<wbr>protection.outlook.com/?url=<wbr>https%3A%2F%2Fwiki.shibboleth.<wbr>net%2Fconfluence%2Fx%2FcoFAAg&<wbr>data=02%7C01%7CAlexander.F.<wbr>French%40dartmouth.edu%<wbr>7Ce4d30a0b666f4ea9f96f08d5675f<wbr>ed4f%<wbr>7C995b093648d640e5a31ebf689ec9<wbr>446f%7C0%7C0%<wbr>7C636528584059351048&sdata=<wbr>H40wzVggsHQaInTs4J8wAzVOBjyJpw<wbr>m6l5ueMnRobRc%3D&reserved=0</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote></div><br></div>