search

mitcho / shibboleth

WordPress Shibboleth plugin
24 stars 23 forks source link

Allow SHIB_SESSION_ID as Shibboleth session header #20

Closed ck-ws closed 8 years ago

ck-ws commented 8 years ago

this is used by some server implementations, e.g. lighttpd. In lighttpd all SERVER-Variable names are uppercased and dashes are replaced by underscores.

If this isn't modified as in the patch below, I get the known redirect of death ;)

This also affects the normal attributes, but there it's possible to transform them to uppercase myself in the config (uid -> UID, isMemberOf -> ISMEMBEROF).

dsXLII commented 8 years ago

Wonder if it would be worthwhile (and safe) to just make the whole header ID case-insensitive.

ck-ws commented 8 years ago

That's actually the way I implemented it in my own applications. HTTP Headers are case-insensitive, but the _SERVER variables aren't. But again the usual _SERVER variables like PHP_SELF, REDIRECT_URI, etc. are all uppercase by default.

Wasn't sure if this would be accepted, so I chose the less intrusive way, which would also be fine for me, since the other attributes can be configured.

jrchamp commented 8 years ago

13 uses getenv() which is case-insensitive and should fix this issue. Plus, all the other benefits it was written to solve.

ck-ws commented 8 years ago

Haven't seen that. I would vote for #13, too!