[JIRA] (IDP-2084) RemoteUser authn servlet uses hardcoded checkHeaders

[Tero Marttila (Jira)]

Tero Marttila ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5c642d8a911797593beaebd4 ) *commented* on IDP-2084 ( https://shibboleth.atlassian.net/browse/IDP-2084?atlOrigin=eyJpIjoiZTQ1ZDRiMDA0MTZkNDM2OGExNTBiMTc5YTU0MDRmMmMiLCJwIjoiaiJ9 )

Re: RemoteUser authn servlet uses hardcoded checkHeaders ( https://shibboleth.atlassian.net/browse/IDP-2084?atlOrigin=eyJpIjoiZTQ1ZDRiMDA0MTZkNDM2OGExNTBiMTc5YTU0MDRmMmMiLCJwIjoiaiJ9 )

I agree with your interpretation of the exposure, because this breaks any RemoteUser authn flows relying on HTTP request headers in such an obvious manner that it wouldn’t make it past initial testing.

However, I sent a quick follow-up to security at shibboleth.net with a question just to confirm my interpretation of the impact.

( https://shibboleth.atlassian.net/browse/IDP-2084#add-comment?atlOrigin=eyJpIjoiZTQ1ZDRiMDA0MTZkNDM2OGExNTBiMTc5YTU0MDRmMmMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2084#add-comment?atlOrigin=eyJpIjoiZTQ1ZDRiMDA0MTZkNDM2OGExNTBiMTc5YTU0MDRmMmMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100219- sha1:6a6077b )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230330/4feeec35/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-45f41bf8-df48-433e-a08c-3b0630652628
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230330/4feeec35/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c663f217-d8f2-4acc-9077-df033db63d2e
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230330/4feeec35/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-f079efc8-a074-4d5a-a33d-17efcbb62297
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230330/4feeec35/attachment-0005.png>