Principal from the IDP usernamePassword login handler versus mod_auth_kerb

[Cantor, Scott]

On 12/19/12 4:59 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:

>Anyone else have to work around this? As far as I can tell, I can try to
>find a way to get Apache to modify REMOTE_USER before passing it to
>Tomcat, I can write some fancy logic for the principal in the IDP that
>removes the domain name if it exists, or I can give up and take the JAAS
>approach instead of mod_auth_kerb which, for all I know, might get me
>back to where I started.

I went with the JAAS approach because I had to configure that anyway, to
use my modified version of the user/pass handler.

I preferred that to having a separate configuration (and I didn't have
Apache in front anymore anyway).

> 
>If there¹s a better way to do this, either via configuration of
>mod_auth_kerb or of the IDP, please let me know!

I don't think there's anything you can do to mod_auth_kerb, so if you want
to use that, you'd have to deal with it in the resolver.

-- Scott