Principal from the IDP usernamePassword login handler versus mod_auth_kerb

[Wessel, Keith William]

All,

Hoping there's an easy solution here.

I'm finally setting up ECP support for our IDP.

Right now, we use the usernamePassword login handler for browser-based auth. Via jaas and Kerberos auth against our AD, it's gracious enough to pull off the domain name from AD and just return the username without @domain as the principal. I know this differs from IDP versions before 2.3 (and maybe 2.2). We used to have to parse off the domain name from the principal before looking it up in our LDAP for attributes.

Enter ECP. For simplicity, I was just planning to use mod_auth_kerb rather than a JAAS-based approach to protect our ECP endpoint. The problem: the principal being passed in through REMOTE_USER is username at domain.

Anyone else have to work around this? As far as I can tell, I can try to find a way to get Apache to modify REMOTE_USER before passing it to Tomcat, I can write some fancy logic for the principal in the IDP that removes the domain name if it exists, or I can give up and take the JAAS approach instead of mod_auth_kerb which, for all I know, might get me back to where I started.

If there's a better way to do this, either via configuration of mod_auth_kerb or of the IDP, please let me know!

Thanks,
Keith

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121219/19ae0682/attachment.html