Uploads over SSL failing after SAML integration

[Cantor, Scott]

On 12/3/12 3:56 PM, "MikeWho" <who at me.com> wrote:
>
>One final question - now that Authentication.aspx has requireSession =
>false; is it still safe from spoofing? Does Shibboleth still clear the
>headers to prevent this (the only header we're reading is the user
>identity
>from the HTTP_REMOTEUSER field).

Yes, that's the purpose of setting authType.

I wouldn't use HTTP_REMOTEUSER, stick with something explicit. That hack
wasn't really a great idea and is just confusing with respect to the real
REMOTE_USER.

-- Scott