<div dir="ltr"><div dir="ltr"><div>There are a lot of parts involved here:<br></div><div>"Load Balancer" --> IIS [ ShibNative --> isapi_redirect ] --> tomcat via AJP</div><div> </div><div>With the following config I believe the server variables are being passed through the isapi_redirect and process correctly by Tomcat.</div><div><br></div><div><InProcess><br> <ISAPI normalizeRequest="true" safeHeaderNames="true"><br></div><div> .....</div><div></InProcess></div><div><br></div><div> <ApplicationDefaults entityID="<a href="https://some-test-host.x.edu/cf-test/shibboleth">https://some-test-host.x.edu/cf-test/shibboleth</a>"<br> REMOTE_USER="eppn subject-id pairwise-id persistent-id"<br> cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"<br> attributePrefix="HTTP_"><br></div><div><br></div><div>^specified "HTTP_" as the attributePrefix because it appears that the isapi_redirect does not honor "AJP_".</div><div><br></div><div>The variables are then accessible as:</div><div><br></div><div>CGI.FirstName<br></div><div>CGI.eppn</div><div>etc ..</div><div><br></div><div>Is this a more reasonable / secure / safe configuration for this particular environment ?</div><div><br></div><div>Thanks!</div><div>-John S</div><div><br></div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 20, 2019 at 9:27 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 6/20/19, 9:23 AM, "Hong Ye" <<a href="mailto:hy93@cornell.edu" target="_blank">hy93@cornell.edu</a>> wrote:<br>
<br>
> If it is not safe to use headers, does Shibboleth SP set attributes as server variables?<br>
<br>
Yep. In IIS also.<br>
<br>
> I dump all the cgi variables and<br>
> didn't see any attributes in there.<br>
<br>
There is no reliable way to do that in most newer software because they build the list of variables in unreliable ways, but even if there was, that would mean the system isn't configured correctly. Without directly accessing a variable, you can't really know whether it's there or not. Dumping variable lists is a nice debugging tool but it is big time insecure to do that, so in some ways it's a good thing it no longer works well.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><span style="font-size:14px;line-height:24px;color:rgb(68,68,68);font-family:"Open Sans",Helvetica,Arial,sans-serif">John Schrader</span><br></div><div><font color="#444444" face="Open Sans, Helvetica, Arial, sans-serif"><span style="font-size:14px;line-height:24px">Identity and Access Management</span></font></div><div><font color="#444444" face="Open Sans, Helvetica, Arial, sans-serif"><span style="font-size:14px;line-height:24px">Office of Information Technologies</span></font></div><div><font color="#444444" face="Open Sans, Helvetica, Arial, sans-serif"><span style="font-size:14px;line-height:24px">University of Notre Dame</span></font></div><div><br></div><div dir="ltr"><span style="color:rgb(68,68,68);font-family:"Open Sans",Helvetica,Arial,sans-serif;font-size:14px;font-style:italic;line-height:24px">EVERYTHING SHOULD BE MADE AS SIMPLE AS POSSIBLE, BUT NOT ANY SIMPLER</span><div><span style="color:rgb(68,68,68);font-family:"Open Sans",Helvetica,Arial,sans-serif;font-size:14px;font-style:italic;line-height:24px">—ALBERT EINSTEIN</span><br></div></div></div></div></div></div></div></div></div>