3

I would like to iterate through all available attributes in a ServletRequest. But somehow when doing that, not all available attributes are shown. It seems this way because when requesting a specific attribute that wasn't shown in the enumeration, the value gets printed correctly.

Code for iterating attributes and for showing specific attribute

HttpServletRequest request = this.getHttpServletRequest();
Enumeration en = request.getAttributeNames();
while (en.hasMoreElements())
{
    Object currentElem = en.nextElement();
    System.out.println("currentElem.getClass(): " + currentElem.getClass());
    System.out.println("currentElem.toString(): " + currentElem);
}
Object specificAttrValue = request.getAttribute("Shib-Identity-Provider");
System.out.println("\nspecific attr: " + specificAttrValue);

Output:

currentElem.getClass(): class java.lang.String
currentElem.toString(): corsFilter.FILTERED
currentElem.getClass(): class java.lang.String
currentElem.toString(): org.springframework.web.context.request.RequestContextListener.REQUEST_ATTRIBUTES
currentElem.getClass(): class java.lang.String
currentElem.toString(): __spring_security_scpf_applied
currentElem.getClass(): class java.lang.String
currentElem.toString(): __spring_security_session_mgmt_filter_applied
currentElem.getClass(): class java.lang.String
currentElem.toString(): org.springframework.security.web.FilterChainProxy.APPLIED
currentElem.getClass(): class java.lang.String
currentElem.toString(): __spring_security_filterSecurityInterceptor_filterApplied

specific attr: https://idp.testshib.org/idp/shibboleth

Why does the iteration not show Shib-Identity-Provider as an available attribute?

How do I iterate through the actually available attributes that are "hidden"?

Note: The attributes I would like to access are being set by the Shibboleth Service Provider. The request first goes to an Apache server, then to Shibboleth, then to the testshib.org Identity Provider, back to Shibboleth and depending on the contents the request gets enriched by some attributes (these are the ones I need to access) and then it gets routed to the Tomcat servlet.

backendev
  • 267
  • 6
  • 15
  • 1
    `getAttributeNames()` actually returns `Enumeration`, using this would make your code sample easier to read, i.e. no printing of attribute name class names (they're all strings anyway). – ci_ May 12 '15 at 14:12
  • I read in the Javadoc of the method that it returns an Enumeration of Strings, but when declaring the variable as `Enumeration` the compiler warns that an unchecked conversion to String is necessary. – backendev May 12 '15 at 14:57
  • Apparently this happens for both Tomcat and Glassfish. People on the Shibboleth list seem to think it's a bug: http://shibboleth.net/pipermail/users/2015-June/022260.html – Philip Durbin Jun 20 '15 at 02:36

1 Answers1

1

If I see this post which has the same problem: Retrieving Shibboleth attributes from AJP connector request

It looks like the getAttributeNames() of this container isn't well implemented for some reason and doesn't return all of the attributes

This links may help too:

Community
  • 1
  • 1
Gary SEBASTIANI
  • 302
  • 1
  • 15
  • Thanks. So the three posts indicate that getting an attribute directly via name works, getting after setting it yourself works, but getting via Iteration through all attributes doesn't work. Just like you, I would also conclude that there seems to be a bug in the getAttributeNames() of the container. I'll try to find a way to change that. I'll accept your answer if I don't find one (I just don't want to give up hope yet :) ) – backendev May 19 '15 at 16:01
  • I don't really know this framework so I could not conclude as I haven't tested it. If I were you, I would take a close look to your configuration, as it could be the easiest solution (the only one actually). The fact that getAttributeNames() doesn't work isn't really a solution, but more probably a ["features"](http://fr.wiktionary.org/wiki/it%E2%80%99s_not_a_bug,_it%E2%80%99s_a_feature) of Shibboleth – Gary SEBASTIANI May 19 '15 at 16:11
  • I didn't have time to inspect this issue further and used the workaround of passing the request along instead of an attribute map so that the method can access the request directly. For everyone who wants to inspect this issue further, maybe inspect internal values in the used Request class (depends on Framework, was this one for me: http://grepcode.com/file/repo1.maven.org/maven2/org.apache.geronimo.ext.tomcat/catalina/7.0.39.2/org/apache/catalina/connector/RequestFacade.java#RequestFacade.getAttributeNames%28%29 ) and the used superclasses. Just an idea - might also be a dead end. – backendev May 27 '15 at 15:37