AJP attributes sent by Apache mod_proxy_ajp from AJP_ prefixed environment variables are not set as HttpRequest attributes as is the case with JBoss AS 7, Glassfish 3 and 4 or Tomcat.

This disallow, in my case, to pass in a secure way Shibboleth security sensitive information extracted from SAML assertions to servlets.