<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:Consolas;}
p.CodeStyle, li.CodeStyle, div.CodeStyle
{mso-style-name:CodeStyle;
mso-style-link:"CodeStyle Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Georgia",serif;}
span.CodeStyleChar
{mso-style-name:"CodeStyle Char";
mso-style-link:CodeStyle;
font-family:"Georgia",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle22
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I’m spending some time upgrading the SP on an IIS server to the latest version since it was running V2 and using the outdated ISAPI filter.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For the best security, the latest module version defaults to using server variables instead of headers to prevent client spoofing. This seems to work fine for ASP apps (via System.Web.UI.PageHandlerFactory handler) and PHP apps (via the
FastCGI module) but for ColdFusion, this doesn’t work. I just cannot access these server variables.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The docs (<a href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335257/AttributeAccess">https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335257/AttributeAccess</a>) give specific examples of how to access the server
variables for ColdFusion but this doesn’t seem to work. Specifically, it states to use the syntax “CGI.Shib-Identity-Provider”, but this always results in a ColdFusion error “The value '' cannot be converted to a number.” which makes sense because the interpreter
see’s the dash and assumes that the code is trying to subtract two variables. However, even something like CGI[“Shib-Identity-Provider”] doesn’t work….it returns no value.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I cannot determine if this issue is a ColdFusion proper issue or the Tomcat Connector for IIS that CF uses. I decompiled the coldfusion.runtime.CgiScope class I can see where it would try to resolve the value for some name from request.getAttribute(),
but again – I always get no value, even when the SP is protecting the page. This leads me to believe that it’s a Tomcat Connector issue (which is an ISAPI filter – not a module
<span style="font-family:Wingdings">L</span>). I’ve read on some other forums that in order to access certain CGI variables in CF fronted by Apache that you need to declare them in mod_jk.conf via the “JkEnvVar” directive. It doesn’t look like the IIS connector
has any such option so I cannot try it.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are running the latest version of ColdFusion (2023) and IIS 10. Has anyone else gotten this to work or am I stuck having to live with useHeaders=true?<o:p></o:p></p>
</div>
</body>
</html>