<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>I am setting up an Apache 2 proxy with shibboleth. The service being proxied to (Odoo) wants the SSO user and a session ID, so I did this:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> RequestHeader set Remote-User %{SHIB_mail}e env=SHIB_mail<o:p></o:p></p><p class=MsoNormal> RequestHeader set Shib-Session %{SHIB_Shib_Session_ID}e env=SHIB_Shib_Session_ID<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Those vars start SHIB_ because my attributePrefix is “SHIB_” (in shibboleth2.xml).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I wrote a small cgi-bin in the same virtual host to make sure those environment variables are visible. They are. And, in fact, I can set lots of headers based on env vars like SHIB_mail, SHIB_givenName, and others. But, for some reason SHIB_Shib_Session_ID doesn’t work. Again, I can confirm that when I wrote this small cgi (snippet of python):<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> for key, value in os.environ.items():<o:p></o:p></p><p class=MsoNormal> print(f"{key}: {value}")<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>that I see SHIB_mail, SHIB_givenName,, and SHIB_Shib_Session_ID. Yet they aren’t getting rewritten.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I made a second attempt using mod_rewrite:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> RewriteEngine On<o:p></o:p></p><p class=MsoNormal> RewriteCond %{LA-U:SHIB_Shib_Session_ID} (.+)<o:p></o:p></p><p class=MsoNormal> RewriteRule . - [E=RU:%1]<o:p></o:p></p><p class=MsoNormal> RequestHeader set Shib-Session %{SHIB_Shib_Session_ID}s # note I tried %{SHIB_Shib_Session_ID}e here as well but I think it’s a server variable by this point<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>That didn’t work, either. In the first example (RequestHeader set) the header is simply not written. In the second example, it has the value (null).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I feel like the issue has something to do with when the session ID becomes available, and that for some reason other attributes are set before “RequestHeader set” but not the session ID. Could that be the case? Or there something magical about SHIB_Session_ID that makes it not visible to a rewrite rule on a proxy? (I can’t see how that could be, but I don’t know what I don’t know).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>--Chris<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>