REMOTE_USER definition question

[csross]

I am protecting 2 sites/vhosts on my SP, each defined in an
<ApplicationOverride>. One is in production and the it's IDP is shibboleth. 
It uses the default REMOTE_USER="eppn persistent-id targeted-id". 

On a test server, I set up a different vhost to protect and its IDP is
Opensso.  I edited the default REMOTE_USER to include uid, which the idp is
releasing.  REMOTE_USER="eppn uid persistent-id targeted-id".  uid is
correctly defined in attribute-map.xml.   On a test server it is the only
vhost and is working fine. 

I was told yesterday that the IDP admin is changing the name of the
attribute it is sending to sysID.  I removed 'uid' from the REMOTE_USER
variable, leaving the defult "eppn persistent-id targeted-id" just to check
the logs for the entries I got, and restarted shibd.

I was still able to log in as if I hadn't removed the variable.  I looked at
the transaction_log and it showed that 'uid' is still coming through.

Why would uid come through if I do not have that variable specified in
REMOTE_USER?  Are they just placeholders and as long as the
attribute-map.xml has the matching definition for what is being sent, it may
work?

Then I looked at the production server's transaction log and see more than 3
attributes received even when REMOTE_USER only has eppn, persistent-id and
targeted-id.  (ie) employeeNumber1 (1 values), sn (1 values), givenName (1
values), cn (1 values), mail (1 values)).  

I am confused at the relationship between what is defined in REMOTE_USER and
what is received.  

Thanks for any help.




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/REMOTE-USER-definition-question-tp7582378.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.