Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Shibbolethv2.3 with Apache web server and Tomcat application server. I am using Apache as a reverse proxy using I am not able to forward the Shibboleth environment variables from Apache to Tomcat. I am able to forward the attributes in the headers but as already mentioned in the wiki this approach is not safe. I have tried forwarding the environment variables by the following directive :

SetEnv AJP_username ${username}

then at the Java side I can access the attribute by : request.getAttribute("username"); The strange thing here is that, I get a different value instead of the one set by Shibboleth. I get the Windows account name as a result. If I use any other attribute name, I get a null value.

I have searched a lot and have run out of options. Please guide me towards the right solution.

My setup details :

  1. Shibboleth version : 2.3
  2. OS : Windows XP SP3
  3. Webserver : Apache 2.2
  4. Application Server : Tomcat 6
  5. Proxy module :
share|improve this question

migrated from Sep 27 '12 at 3:20

This question came from our site for computer enthusiasts and power users.

Make sure that your attribute-map.xml is set up correctly, sharing it might help. – fuero Jul 29 '14 at 22:58

Make sure you are proxying through using ajp in the httpd.conf

ProxyPass /example ajp://

And in the shibboleth2.xml in the ApplicationDefaults section we need to add


So it looks something like

<ApplicationDefaults id="default" policyId="default"
    REMOTE_USER="eppn persistent-id targeted-id"
    signing="false" encryption="false" attributePrefix="AJP_">

Check out this question on the shib mailing list:

share|improve this answer
Why the prefix? – Matteo Jun 2 '14 at 6:05
Prefix seems to be needed but the attributes are available without prefix in Java. – Panu Haaramo Dec 2 '14 at 12:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.