IDP authn when using ECP

[Steven Carmody]

I have my test IDP in tomcat; I do NOT use apache in front of it.

I have the IDP configured to use the UsernamePassword authentication 
method; it pops up a form and then authenticates against kerberos.

I'm starting to experiment with ECP support, however, starting with 
Scott's script. For this to work properly, the IDP has to respond with 
Basic AUth, rather than a form.

I'm pretty sure I can configure Basic Auth support in tomcat, by adding 
a <security-constraint> with the appropriate path to the web.xml file 
associated with the IDP.

But, it appears that the only relevant LoginHandler in the IDP wants to 
receive the userid in REMOTE_USER... and I can't see how to tell Tomcat 
to set that value. I doubt there is any way to do that.

Can anyone suggest a way to configure tomcat and the IDP to use Tomcat's 
basic authn support ?

... or... do I have to use apache in front of tomcat ?

Thanks!