I am running apache 2.4 with the mod_auth_mellon module configured so that I can access our corporate SSO server to authenticate a particular virtualhost. The application running on that virtualhost is an Oracle JET application which is a pure javascript SPA application which needs to access the logged in user's email address.

My web root structure looks like:

/var/www/
    cgi-bin
    example1
        index.html  (the JET application)
    example2
        index.html (another application not requiring authentication)
    example3
        index.html (another application not requiring authentication)

In my apache conf.d folder I have the following vhosts.conf:

<VirtualHost example1:80>
    ServerName example1
    DocumentRoot /var/www/example1
    redirect permanent / <url of sso login>
</VirtualHost>
<VirtualHost example1:443>
    ServerName example1:443
    DocumentRoot /var/www/example1
</VirtualHost>
<VirtualHost example2:80>
    ServerName example2:80
    DocumentRoot /var/www/example2
</VirtualHost>
<VirtualHost example3:80>
    ServerName example3:80
    DocumentRoot /var/www/example3
</VirtualHost>

In my conf.d/mellon.conf I have: MellonEnable info MellonEndpointPath /mellon/ MellonSPMetadataFile /etc/httpd/saml2/sp_metadata.xml MellonSPPrivateKeyFile /etc/httpd/saml2/sp.key MellonSPCertFile /etc/httpd/saml2/sp.cert MellonIdPMetadataFile /etc/httpd/saml2/idp_metadata.xml MellonSetEnvNoPrefix REMOTE_USER NAME_ID MellonSessionDump on MellonSamlResponseDump on

<Location /var/www/example1>
    AuthType    Mellon
    MellonEnable auth
    Require valid-user
</Location>

<Location /var/www/example2>
    AuthType    Mellon
    MellonEnable off
</Location>
<Location /var/www/example3>
    AuthType    Mellon
    MellonEnable off
</Location>

My problem is that When I access http://example1.com, I am redirected to the sso login server and after entering in my credentials I am redirected to the example1/index.html page, and I can see in my apache log file that the user's email is getting stored as an apache environment variable which my application cannot access since the javascript is running on the client not the server. Examining the http headers doesn't show any information about the saml payload, and the mellon-cookie only has the user's session id in it.

Am I misconfiguring something such that I am not getting any saml information back in the headers, or does mod_auth_mellon just consume the headers and not pass them along to the application.

Is there a way to modify the configuration to either have information sent to the application or to have the mellon-cookie include an additional attribute such as the mellonUser?