Shibboleth Developers

["Scott Cantor" <>]

> -  a fastcgi responder (shibresp) that handles the HandlerURL (sorry
> about the language :) )
> - a fastcgi authorizer that acts as a filter and does the usual
> (authN, export assertions and authZ). The only difference is that the
> attributes are exported as environment variables for the underlying
> application, this is a fastcgi limitation but I think this is not a
> problem.

That's typically better, the Apache module is already fixed by Jim to do
this instead of using headers, and it will be the default for 2.0.

It does change the names you can use to refer to attributes, so there are
portability issues with it that people have to recognize, but that's ok.

> I have a PHP application being served behind shibboleth. Note the env
> variables SHIB_SCHEMA and SHIB_CONFIG used to configure the fastcgi
> applications, this is mandatory.

Glad we included the option. ;-)

Anyway, that seems to make sense to me, I hadn't ever looked much at it, but
the handler is something that should be doable in CGI since shibd maintains
the state anyway.

> I hope you find this useful, it is to me.

I think you're working on getting the agreement signed right? This code I
would very much like to check in and support since it's less specialized
than lighttpd.

In the next few weeks, I'd also like to have you try and port it to the new
API as well, which shouldn't be too different.

-- Scott