Adding header sanitizing option.

diff --git a/configs/shibboleth.xml.in b/configs/shibboleth.xml.in
index 8989b82..76430a1 100644 (file)
--- a/configs/shibboleth.xml.in
+++ b/configs/shibboleth.xml.in
@@ -81,7 +81,7 @@
                </RequestMapProvider>
                
                <Implementation>
-                       <ISAPI normalizeRequest="true">
+                       <ISAPI normalizeRequest="true" safeHeaderNames="true">
                                <!--
                                Maps IIS Instance ID values to the host scheme/name/port/sslport. The name is
                                required so that the proper <Host> in the request map above is found without

diff --git a/schemas/shibboleth-targetconfig-1.0.xsd b/schemas/shibboleth-targetconfig-1.0.xsd
index f40ba61..8bf3002 100644 (file)
--- a/schemas/shibboleth-targetconfig-1.0.xsd
+++ b/schemas/shibboleth-targetconfig-1.0.xsd
@@ -7,7 +7,7 @@
        elementFormDefault="qualified"
        attributeFormDefault="unqualified"
        blockDefault="substitution"
-       version="1.3.1">
+       version="1.3.2">
 
        <import namespace="urn:oasis:names:tc:SAML:1.0:assertion" schemaLocation="cs-sstc-schema-assertion-1.1.xsd"/>
        <import namespace="urn:oasis:names:tc:SAML:2.0:metadata" schemaLocation="saml-schema-metadata-2.0.xsd"/>
@@ -190,6 +190,7 @@
                <attribute name="localRelayState" type="boolean" use="optional" default="false"/>
                <attribute name="unsetHeaderValue" type="conf:string" use="optional"/>
                <attribute name="checkSpoofing" type="boolean" use="optional"/>
+        <attribute name="spoofKey" type="conf:string" use="optional"/>
                <attribute name="catchAll" type="boolean" use="optional"/>
                <anyAttribute namespace="##other" processContents="lax"/>
        </complexType>
@@ -212,6 +213,7 @@
                                <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                        </sequence>
                        <attribute name="normalizeRequest" type="boolean" use="optional"/>
+            <attribute name="safeHeaderNames" type="boolean" use="optional"/>
                        <anyAttribute namespace="##other" processContents="lax"/>
                </complexType>
        </element>