<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri",sans-serif;
font-weight:bold;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle22
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">Hi All,<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">We have a legacy product that does not support SAML OOTB, so 2+ years ago I documented how to configure this with Shib v2 & IIS. I am trying to update this to V3 and am not getting
the headers (or variables) coming through. My requirement is incredibly simple - just pass through the users identifer as a header.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">I have gotten the SAML working and /Shibboleth.sso/Session shows:<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Miscellaneous<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Session Expiration (barring inactivity): 479 minute(s)<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Client Address: fe80::6118:242a:7:97d8%3<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Identity Provider: http://ADFS.wxyzlocal.net/adfs/services/trust<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Authentication Time: 2018-08-14T13:12:16.201Z<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Authentication Context Decl: (none)<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Attributes<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">eppn: wxyz@wxyzlocal.net<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">upn: wxyz@wxyzlocal.net<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">Either of these (as they are really the same thing) would be fine to use.
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">I have set use headers to true (twice - I am sure the second is redundant):<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><InProcess><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"> <ISAPI normalizeRequest="true" safeHeaderNames="true" useHeaders="true"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"> <Site id="1" name="myserver" scheme="https" port="443"
useHeaders="true" /><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"> </ISAPI><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"></InProcess><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">I am trying to set the header the same way I was in v2 ( I don’t need the header to be remoteuser, but that is what worked in V2) :<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><ApplicationDefaults entityID="https://myserver/shibboleth"
homeURL="/myapp/index.htm" REMOTE_USER="eppn"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">And I have tried to pass through all attributes:<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><afp:AttributeFilterPolicy><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><!-- This policy is in effect in all cases. --><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><afp:PolicyRequirementRule xsi:type="ANY"/><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><!--<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Filter out undefined affiliations and ensure only one primary.
<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">--><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><!--<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">Catch-all that passes everything else through unmolested.
<o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1">--><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"><afp:AttributeRule attributeID="*" permitAny="true"/><o:p></o:p></span></p>
<p class="MsoNormal" style="background:#EFF0F1;vertical-align:baseline"><span style="font-size:10.0pt;font-family:Consolas;color:#242729;border:none windowtext 1.0pt;padding:0in;background:#EFF0F1"></afp:AttributeFilterPolicy><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">Now, I am sure it is something I have done, but I am stuck. outputting the data (using the aspx code from the documentation I see "REMOTE_USER = " under server variables and don't see
it at all under headers.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">Any idea what I have missed/what has changed?<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">NB: Full output from aspx is below. I see no reference to Shib at all other than the cookie..<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:13.5pt">Server Variables<o:p></o:p></span></b></p>
<p class="MsoNormal">ALL_HTTP = HTTP_CONNECTION:close HTTP_ACCEPT:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 HTTP_ACCEPT_ENCODING:gzip, deflate, br HTTP_ACCEPT_LANGUAGE:en-US,en;q=0.5 HTTP_COOKIE:_shibsession_64656661756c7468747470733a2f2f716d692d71762d6969732f73686962626f6c657468=_26f717623595cc347947fbf32fb7a852;
AccessPointSession=60862363-1334-1d2f-bdff-9133d205811e HTTP_HOST:myserver HTTP_USER_AGENT:Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0 HTTP_UPGRADE_INSECURE_REQUESTS:1
<br>
ALL_RAW = Connection: close Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.5 Cookie: _shibsession_64656661756c7468747470733a2f2f716d692d71762d6969732f73686962626f6c657468=_26f717623595cc347947fbf32fb7a852;
AccessPointSession=60862363-1334-1d2f-bdff-9133d205811e Host: myserver User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0 upgrade-insecure-requests: 1
<br>
APPL_MD_PATH = /LM/W3SVC/1/ROOT/test<br>
APPL_PHYSICAL_PATH = C:\inetpub\test\<br>
AUTH_TYPE = <br>
AUTH_USER = <br>
AUTH_PASSWORD = <br>
LOGON_USER = <br>
REMOTE_USER = <br>
CERT_COOKIE = <br>
CERT_FLAGS = <br>
CERT_ISSUER = <br>
CERT_KEYSIZE = 256<br>
CERT_SECRETKEYSIZE = 2048<br>
CERT_SERIALNUMBER = <br>
CERT_SERVER_ISSUER = CN=myserver<br>
CERT_SERVER_SUBJECT = CN=myserver<br>
CERT_SUBJECT = <br>
CONTENT_LENGTH = 0<br>
CONTENT_TYPE = <br>
GATEWAY_INTERFACE = CGI/1.1<br>
HTTPS = on<br>
HTTPS_KEYSIZE = 256<br>
HTTPS_SECRETKEYSIZE = 2048<br>
HTTPS_SERVER_ISSUER = CN=myserver<br>
HTTPS_SERVER_SUBJECT = CN=myserver<br>
INSTANCE_ID = 1<br>
INSTANCE_META_PATH = /LM/W3SVC/1<br>
LOCAL_ADDR = fe80::6118:242a:7:97d8%3<br>
PATH_INFO = /test/test.aspx<br>
PATH_TRANSLATED = C:\inetpub\test\test.aspx<br>
QUERY_STRING = <br>
REMOTE_ADDR = fe80::6118:242a:7:97d8%3<br>
REMOTE_HOST = fe80::6118:242a:7:97d8%3<br>
REMOTE_PORT = 49699<br>
REQUEST_METHOD = GET<br>
SCRIPT_NAME = /test/test.aspx<br>
SERVER_NAME = myserver<br>
SERVER_PORT = 443<br>
SERVER_PORT_SECURE = 1<br>
SERVER_PROTOCOL = HTTP/1.1<br>
SERVER_SOFTWARE = Microsoft-IIS/10.0<br>
URL = /test/test.aspx<br>
HTTP_CONNECTION = close<br>
HTTP_ACCEPT = text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<br>
HTTP_ACCEPT_ENCODING = gzip, deflate, br<br>
HTTP_ACCEPT_LANGUAGE = en-US,en;q=0.5<br>
HTTP_COOKIE = _shibsession_64656661756c7468747470733a2f2f716d692d71762d6969732f73686962626f6c657468=_26f717623595cc347947fbf32fb7a852; AccessPointSession=60862363-1334-1d2f-bdff-9133d205811e<br>
HTTP_HOST = myserver<br>
HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0<br>
HTTP_UPGRADE_INSECURE_REQUESTS = 1<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:13.5pt">HTTP HEADERS<o:p></o:p></span></b></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
Connection = close<br>
Accept = text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8<br>
Accept-Encoding = gzip, deflate, br<br>
Accept-Language = en-US,en;q=0.5<br>
Cookie = _shibsession_64656661756c7468747470733a2f2f716d692d71762d6969732f73686962626f6c657468=_26f717623595cc347947fbf32fb7a852; AccessPointSession=60862363-1334-1d2f-bdff-9133d205811e<br>
Host = myserver<br>
User-Agent = Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0<br>
upgrade-insecure-requests = 1<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white;vertical-align:baseline">
<span style="font-size:11.5pt;font-family:"Arial",sans-serif;color:#242729">Thanks<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Arial",sans-serif;color:#62AC1E"><br>
Leigh Kennedy </span><span style="font-family:"Arial",sans-serif;color:#333333"><br>
<br>
</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>