Retrieve custom attributes from shibboleth SP (best practices)

Question

I have a shibboleth service provider with Apache httpd and the id is sent to me the attributes.

So, I am able to retrieve the custom attributes from https://mysp/Shibboleth/Session, all what i need is to send a request from the front-end (ReactJs) to this link and get all attributes.

Now, we are going into the production environment, but this way to retrieve attributes from the session is not recommended for production env.

So do you know a way to retrieve the attributes of the authenticated user and forward the data to the front-end apps?

Thank you in advance

score 1 · Answer 1 · answered Oct 26 '18 at 17:49

You can't access the attribute directly from client-side. There must be some server-side code. See: How to access Shibboleth SP Attributes in AngularJS Application for a similar request with AngularJS.

Shibboleth SP exposes the attributes as server-variables, and can be accessed from server-side code only, see: Shibboleth Service Provider 3.x Attribute Access (Also, the deprecated but still in wide-deployment NativeSPAttributeAccess for SP v2.x).

You can also allow Shibboleth to expose the attribute data using HTTP request headers via ShibUseHeaders On within you Apache config.

If you backend is Node.js, you might consider something other than Shibboleth as your SAML service provider, i.e. saml2-js.

Thank you for your answer, it helped me a lot, so i put another a detailed answer of my issue for anyone who has the same issue, but i will give +1 ;) — h.zak, Oct 30 '18 at 14:43

score 1 · Accepted Answer · answered Oct 30 '18 at 14:40

After my searching and getting help by @Kellen Murphy, the best solution to prevent spoofing is to use env variables.

For example i want to send to my applications the USERNAME attribute.

so, i created a php page that can read session data from the header

<html>
 <head>
  <title>Session data</title>
 </head>
 <body>
<?php
print_r($_SERVER["HTTP_X_USERNAME"]);
?>
 </body>
</html>

Then i started the php page with

php -S localhost:9000

Then i passed the env variable as a header variable

    RequestHeader set X-USERNAME      %{USERNAME}e
    ProxyPass /Session http://localhost:9000
    ProxyPassReverse  /Session http://localhost:9000

now i can retrieve my attributes by attacking the page : https://example.com/Session

Retrieve custom attributes from shibboleth SP (best practices)

2 Answers2