Lately I have been developing a streamlit app and I am using Shibboleth as Auth SSO. I am using Shibboleth v. 3.4.1 and Apache v. 2.4.37. I will try my best to describe the problem I am encountering, bear with me because english is not my first language: I want to profile all authenticated users. I basically want to take their id and assign each user a specific role (possibily i would like to do this on streamlit client side), for example: user with a "student" profile can only view specific pages on my streamlit web app.
I have been following Shibboleth configuration guides, I have my
attribute_map.xml where i map all the user attributes I want, the Shibboleth configuration file shibboleth2.xml, and my application configuration file.
Here are listed all the user attributes at mysite/Shibboleth.sso/Session:
Miscellaneous
Session Expiration (barring inactivity):
Client Address:
SSO Protocol:
Identity Provider:
Authentication Time:
Authentication Context Class:
Authentication Context Decl: (none)
Attributes
agency:
id:
displayName:
login_name:
This is my config file
<VirtualHost *:80>
ServerName <mysite>
ServerAlias <mysite>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule . https://<myurl>%{REQUEST_URI} [R,L]
#RequestHeader set AJP_SHIB_ATTRIBUTE_REMOTE_USER %{AJP_SHIB_ATTRIBUTE_REMOTE_USER}e
#RequestHeader set AJP_SHIB_ATTRIBUTE_<AttributeName> %{AJP_SHIB_ATTRIBUTE_<AttributeName>}e
</VirtualHost>
#<IfModule mod_proxy.c>
#RequestHeader set REMOTE_USER %{REMOTE_USER}s
#RequestHeader set HTTP_SHIB_ATTRIBUTE_<AttributeName> %{HTTP_SHIB_ATTRIBUTE_<AttributeName>}e
#</IfModule>
<VirtualHost *:443>
ServerName <mysite>
DocumentRoot []
Include []
ErrorLog []
CustomLog []
ProxyRequests Off
ProxyPreserveHost On
SSLProxyEngine On
RewriteEngine On
<Location />
AuthType shibboleth
ShibRequestSetting requireSession 1
ShibRequestSetting applicationId <mysite>
ShibUseHeaders Off
Require valid-user
ProxyPass ajp://<myip>/ timeout=300
ProxyPassReverse ajp://<myip>/
</Location>
</VirtualHost>
I want to get Shibboleth user Attributes (actually I need only id) and display them in the web browser's headers. I have already tried to set ShibUseHeaders On but it's not working and I can't see the authenticated user attributes anywhere on my browser log panel.
I really cannot understand why the user attributes are not showing in browser headers... Do you have any ideas or suggestion? I would really appreciate some help, I am stuck at this point and I have zero ideas.
Thank you very much and have a nice day.