<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
margin:0in;
font-size:8.5pt;
font-family:Menlo;
color:black;}
span.s1
{mso-style-name:s1;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">TLDR;
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">I can get IdP attributes in servlet-request-headers, but want to (and cannot) get them as request-attributes.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Any guidance appreciated!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">=======================================================================================<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">On this sp3 page
<a href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335257/AttributeAccess#Server-Variables">
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335257/AttributeAccess#Server-Variables</a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">it says that the attribute
</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#172B4D;letter-spacing:-.05pt;background:white">Shib-Identity-Provider was ‘baked into’ the SP.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#172B4D;letter-spacing:-.05pt;background:white">Later in the Tool-Specific Examples, it gives this servlet example:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#172B4D;background:#F4F5F7"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#172B4D;background:#F4F5F7">request.getAttribute("Shib-Identity-Provider")</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">In my servlet, when I say
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">String shibIdProvider = (String) request.getAttribute("Shib-Identity-Provider");<br>
result += "\n\n===============shibIdProvider=====\n" + shibIdProvider;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">my logs show:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">===============shibIdProvider=====<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">null<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">My apache config has<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="p1" style="margin-left:.5in"><span class="s1"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><LocationMatch "/my-stuff/"></span></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="p1" style="margin-left:.5in"><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">
</span></span><span class="s1"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">AuthType shibboleth</span></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="p1" style="margin-left:.5in"><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">
</span></span><span class="s1"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">ShibRequestSetting requireSession 1</span></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="p1" style="margin-left:.5in"><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">
</span></span><span class="s1"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Require valid-user local</span></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="p1" style="margin-left:.5in"><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">
</span></span><span class="s1"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">ShibUseEnvironment On</span></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="p1" style="margin-left:.5in"><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">
</span></span><span class="s1"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">ShibUseHeaders On</span></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="p1" style="margin-left:.5in"><span class="s1"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"></LocationMatch></span></span><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">And my logs show all of the Attributes that my IdP is sending as request-headers.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">But I would like the more-secure method of getting them as request-attributes. Currently, my logs show no request-attributes from the SP.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">In my shibboleth2.xml, my ApplicationDefaults says<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> <!-- Map to extract attributes from SAML assertions. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"> <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">And that seems to have an effect, since if I change the path to “foo”, I don’t get the request-headers any more.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">FWIW, I also tried omitting the ShibUseHeaders line, thinking that perhaps headers / request-attributes were a zero-sum game, i.e. you could only get one or the other. That resulted
in my logs showing no headers, and still no request-attributes.<o:p></o:p></span></p>
</div>
</body>
</html>