Shibboleth Developers

["Howard Gilbert" <>]

> > I suspect that they might be used to generate a friendly name for the
> > attribute across the program API, but there was no code that attached
> > them during the AAP apply() processing.
> 
> It can't. Only a server-specific API can do that. Java servlet calls
> should
> be able to add HTTP request headers, I assume.

There are standard features in the Servlet API to query HTTP headers, but
there is also the capability to store a dictionary object in the Session
object.

A Servlet Filter can't add headers to the Request object it gets, but what
it can do is generate a RequestWrapper object that wraps the original
request and intercepts particular calls, such as the ones that return HTTP
Headers, to return artificial "headers" you create.

I have to be skeptical about an endorsement of Headers from someone who
works with ISAPI and Apache mod-xxx code where, because headers are in HTTP,
they are about the only plausible choice available on bare Web servers. It's
something like a database administrator who says, "Have you considered
tables?" That said, I have to agree that there is nothing better in a
current or proposed standard. So I will map a header where there is a Header
attribute in the AAP, and maybe I will create some dictionary for those who
like to lookup attributes with the raw URN, or where the Header attribute is
missing for the attribute.

Of course what we really want is to be able to apply XACML or something to
the attributes, but that is for sometime in the future.