From 658fa2ffa7552651fef7dffc4041ada14455943d Mon Sep 17 00:00:00 2001 From: Martin Renvoize Date: Fri, 28 Sep 2018 13:31:13 +0100 Subject: [PATCH] Bug 17776: (follow-up) Add note about NativeSPSpoofChecking Content-Type: text/plain; charset=utf-8 Signed-off-by: Marcel de Rooy Amended the text a bit: Hopefully, an uppercase important attracts slightly more attention :) Added the bug number too. --- C4/Auth_with_shibboleth.pm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/C4/Auth_with_shibboleth.pm b/C4/Auth_with_shibboleth.pm index 371f015..dc18a1f 100644 --- a/C4/Auth_with_shibboleth.pm +++ b/C4/Auth_with_shibboleth.pm @@ -269,6 +269,8 @@ Or (for Plack running): ShibUseHeaders On +IMPORTANT: Please note, if you are running in the plack configuration you should consult https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSpoofChecking for security advice regarding header spoof checking settings. (See also bug 17776 on Bugzilla about enabling ShibUseHeaders.) + =item 5. Configure koha to listen for shibboleth environment variables. -- 2.1.4