getUser Authenticator is returning null | Confluence 4.2.4

[Peter Schober]

* Gordon, Lyndon-Michael <lyndon-michael.gordon at emory.edu> [2012-06-15 18:52]:
> We are running a IDP with shibboleth-2.3.1-0 on RHEL 5.6 x86_64, and
> Confluence connects via it's SP on RHEL 5.2 x86_64 through the
> remoteUserAuthenticator.jar and configuration files.  We were
> operating fine with remoteAuth1.7.3 and Confluence3.4, but stepping
> up to remoteAuth2.1.14 and Confluence4.2.4 breaks.

Jfyi, there's a "compatibility matrix" for versions of Confluence and
the remoteAuthenticator plugin on the Atlassian plugins site, in case
you didn't check already.

> loginFailed Login failed for user
> null. request=com.atlassian.plugin.servlet.PluginHttpRequestWrapper at 78d59bc7,
> username=null, remoteHost=10.110.27.153, remoteIP=10.110.27.153,
> reason=NoUsername

To add to what Scott said: You didn't actually include anything that
showed whether the Shibboleth SP populates httpd's REMOTE_USER.
So check your transaction log that the value you want the SP to map to
REMOTE_USER is there, check your shibboleth2.xml that it's mapped to
REMOTE_USER and check your httpd access log if you find any lines
where REMOTE_USER is written to the log (which by default it will be).
E.g.
$ fgrep -v ' - - ' /var/log/httpd/access-ssl

> header.fullname = X-Shib-cn
> header.email = X-Shib-mail
> header.remote_user = X-Shib-remoteUser
[...]
> LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
]...]
> ProxyPass / ajp://localhost:8009/
[...]
> <Location />
>   AuthType shibboleth
>   require shibboleth
>   ShibUseHeaders On
> </Location>

I wonder why you're using custom HTTP Headers to pass any attributes
to Tomcat when you're using AJP. All the manual mapping of attributes
to custom HTTP Headers (your X-Shib-* stuff) as well as the trickery
with %{AUTHENTICATE_UID}e to pass REMOTE_USER shouldn't be necessary.
With ApplicationDefaults/@attributePrefix="AJP_" set in
shibboleth2.xml it should Just Work, including passing of REMOTE_USER
(provided Tomcat's AJP Connector has set tomcatAuthentication="false").
All of that is documented at
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPJavaInstall
and it may not be related to your problem. Note that I do have an odd
(and very old) confluence install around where data is only accepted
when I set `ShibUseHeaders On` (but still without any manual mappings,
and with header.fullname=displayName set in
remoteUserAuthenticator.properties; and no value for header.remote_user).

> <Location /emory-login/shib/>
>   ShibRequireSession On
>   require valid-user
> </Location>

Apache httpd needs an AuthType in addition to the require directive to
actually do anything (the documentation for 2.2. also says you must
provide an AuthName directive, but this seems not to be strictly
true).
I also don't have any additional Location for the Confluence server we
use(d) but I didn't read your complete config to find out what this is
for, specifically.
Again, if this worked for you in the past it may not be related to
your problem at hand. It's still off, IMHO.
-peter