{"action":"closed","issue":{"url":"https://api.github.com/repos/nginx-shib/nginx-http-shibboleth/issues/11","repository_url":"https://api.github.com/repos/nginx-shib/nginx-http-shibboleth","labels_url":"https://api.github.com/repos/nginx-shib/nginx-http-shibboleth/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/nginx-shib/nginx-http-shibboleth/issues/11/comments","events_url":"https://api.github.com/repos/nginx-shib/nginx-http-shibboleth/issues/11/events","html_url":"https://github.com/nginx-shib/nginx-http-shibboleth/issues/11","id":134476618,"number":11,"title":"Add setting to disable copying variables as headers","user":{"login":"davidjb","id":1002811,"avatar_url":"https://avatars.githubusercontent.com/u/1002811?v=3","gravatar_id":"","url":"https://api.github.com/users/davidjb","html_url":"https://github.com/davidjb","followers_url":"https://api.github.com/users/davidjb/followers","following_url":"https://api.github.com/users/davidjb/following{/other_user}","gists_url":"https://api.github.com/users/davidjb/gists{/gist_id}","starred_url":"https://api.github.com/users/davidjb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidjb/subscriptions","organizations_url":"https://api.github.com/users/davidjb/orgs","repos_url":"https://api.github.com/users/davidjb/repos","events_url":"https://api.github.com/users/davidjb/events{/privacy}","received_events_url":"https://api.github.com/users/davidjb/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-18T04:10:04Z","updated_at":"2016-02-18T06:44:13Z","closed_at":"2016-02-18T06:44:13Z","body":"mod_shib for Apache has `ShibUserHeaders` to control whether attributes get passed as headers to the backend, and we should aim for a similar toggle.  Without automatically copying headers, it's possible and more secure (see README) to copy attributes from the auth request into the backend's environment -- but it currently requires manual handling in the user's config.\r\n\r\nFYI: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig"}}