Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Shibbolethv2.3 with Apache web server and Tomcat application server. I am using Apache as a reverse proxy using mod_proxy.so. I am not able to forward the Shibboleth environment variables from Apache to Tomcat. I am able to forward the attributes in the headers but as already mentioned in the wiki this approach is not safe. I have tried forwarding the environment variables by the following directive :

SetEnv AJP_username ${username}

then at the Java side I can access the attribute by : request.getAttribute("username"); The strange thing here is that, I get a different value instead of the one set by Shibboleth. I get the Windows account name as a result. If I use any other attribute name, I get a null value.

I have searched a lot and have run out of options. Please guide me towards the right solution.

My setup details :

  1. Shibboleth version : 2.3
  2. OS : Windows XP SP3
  3. Webserver : Apache 2.2
  4. Application Server : Tomcat 6
  5. Proxy module : mod_proxy.so
share|improve this question

migrated from superuser.com Sep 27 '12 at 3:20

This question came from our site for computer enthusiasts and power users.

add comment

1 Answer

Make sure you are proxying through using ajp in the httpd.conf

ProxyPass /example ajp://example.org/example

And in the shibboleth2.xml in the ApplicationDefaults section we need to add

attributePrefix="AJP_"

So it looks something like

<ApplicationDefaults id="default" policyId="default"
    entityID="https://idp.example.org"
    REMOTE_USER="eppn persistent-id targeted-id"
    signing="false" encryption="false" attributePrefix="AJP_">

Check out this question on the shib mailing list: http://groups.google.com/group/shibboleth-users/browse_thread/thread/2bdd3e272baf49a2?pli=1

share|improve this answer
    
Why the prefix? –  Matteo Jun 2 at 6:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.