Where are the cas-attribute headers?

[mostolog]

Hi

We're just starting with Apache 2.4 + mod_auth_cas.

So far, we have been able to build it and use Require valid-user and cas-attribute directives.

We'll like to forward cas-attributes to applications using HTTP headers.

Is there any way to achieve this at Apache configuration level/httpd.conf?

How PHP does retrieve that information as a header? We have tried echoing headers starting with HTTP, CAS...without succeeding.

Are we missing something?

Regards

[mostolog]

Hi


Finally, I managed to solve it.

Seems that cas-attribute headers are only sent if CASAuthNHeader directive is enabled.

According to documentation:

Directive: CASAuthNHeader
Default: None
Description: If enabled, this will store the user returned by CAS in an HTTP header accessible to your web applications.

IMHO that's not exactly what's happening, and either of two should be done:

• Fix an error(if any) to return headers always (but when CASScrubRequestHeaders enabled?)
• Update documentation to reflect this directive also has an effect on cas-attribute headers

Should I fill the issue? Which one?

Regards

[David Hawes]

On 30 June 2016 at 12:40, mostolog <most...@gmail.com> wrote:
> Hi
>
>
> Finally, I managed to solve it.
>
> Seems that cas-attribute headers are only sent if CASAuthNHeader directive
> is enabled.

That's correct.

Also note that you may want to set your CASAttributePrefix to
something that does not contain underscores, as Apache 2.4 will
silently drop those headers.

> According to documentation:
>
> Directive: CASAuthNHeader
> Default: None
> Description: If enabled, this will store the user returned by CAS in an HTTP
> header accessible to your web applications.
>
>
> IMHO that's not exactly what's happening, and either of two should be done:
>
> Fix an error(if any) to return headers always (but when
> CASScrubRequestHeaders enabled?)
> Update documentation to reflect this directive also has an effect on
> cas-attribute headers
>
>
> Should I fill the issue? Which one?

The headers are currently coupled to CASAuthNHeader mostly because of
how authorization has evolved over the years, but I could be convinced
that they should have their own directive or even be on all the time.

In the short term documenting this better would help. Feel free to
open an issue discussing all of this, and we can decide what to do
there.