shib_request_use_headers
The `shib_request_use_headers` directive configures NGINX to utilize specific headers from the Shibboleth authorizer's response for further processing.
Description
The shib_request_use_headers directive is part of the Shibboleth authentication request module for NGINX, allowing it to leverage headers provided by a configured Shibboleth FastCGI authorizer. When this directive is set to 'on', NGINX will extract user attributes from the Shibboleth response headers and make these available for subsequent processing during the request handling. This is particularly useful for passing user information through to backend applications or using it in conditional configurations within NGINX. The effectiveness of this directive hinges on correctly configuring both the NGINX server and the Shibboleth FastCGI authorizer, as the headers must be explicitly set in the authorizer's response.
In practice, the directive allows for the creation of dynamic and personalized user experiences by making specific claims about the user's identity (like email or roles) accessible throughout the NGINX request cycle. The parameters of this directive are straightforward; it accepts a flag argument, which can either enable or disable the feature. This flexibility allows administrators to activate or deactivate header usage on a per-configuration basis, depending on the needs of their application flow or security requirements. Care should be taken when handling user attributes from headers to avoid security vulnerabilities related to header spoofing, notably if the headers are used for access control decisions.
Config Example
http {
server {
location /protected {
shib_request_use_headers on;
shib_request /shibboleth-auth;
}
}
}Ensure that headers sent by the Shibboleth authorizer are correctly defined and populated; otherwise, they won't be available within NGINX.
Inspect the response of the Shibboleth authorizer to guarantee that the expected headers are present.
Mismatch between header keys expected in NGINX and those sent by the Shibboleth service may lead to undefined behavior.