shibboleth: use proxy-supplied request header

[jrchamp]

Mojolicious does not have access to the environment variables supplied by the httpd module which connects to the Shibboleth service provider. Instead, using httpd as a reverse proxy allows for us to provide the user_id via a request header. For security, we forcibly unset any pre-existing request header with the name we plan to use and then only set the request header when it is available from the original httpd environment variable.

<Location "/">
        # Shibboleth lazy-loading sessions.
        AuthType shibboleth
        ShibRequestSetting requireSession 0
        require shibboleth

        RequestHeader unset eppn
        RequestHeader set eppn %{eppn}e env=eppn
</Location>

If you have any questions, concerns or suggestions, please let me know.

Fixes #2286

[drgrice1]

This looks good to me. I have no way to test this, but I will trust that it works for you. It can't be any worse than the current state of affairs!

[pstaabp]

I can't test it, but I'll approve it.

[jrchamp]

@xcompass @juu7nitw23 In case you have time to test this update for the Shibboleth authen in the Mojolicious versions of WeBWorK.

[juu7nitw23]

Thanks. I will try to see if I can test it next week

[drgrice1]

We are just going to merge this. If further changes are made, a new pull request can be made.