REMOTE_USER definition question

[Nate Klingenstein]

> I was still able to log in as if I hadn't removed the variable.  I looked at
> the transaction_log and it showed that 'uid' is still coming through.
> 
> Why would uid come through if I do not have that variable specified in
> REMOTE_USER?  Are they just placeholders and as long as the
> attribute-map.xml has the matching definition for what is being sent, it may
> work?
> 
> Then I looked at the production server's transaction log and see more than 3
> attributes received even when REMOTE_USER only has eppn, persistent-id and
> targeted-id.  (ie) employeeNumber1 (1 values), sn (1 values), givenName (1
> values), cn (1 values), mail (1 values)).  
> 
> I am confused at the relationship between what is defined in REMOTE_USER and
> what is received.  

All incoming SAML attributes will be mapped to header variables based on attribute-map.xml.  The easiest documentation is probably:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute

The REMOTE_USER configuration defines how the special REMOTE_USER variable is preferentially populated from these mappings in attribute-map.xml in descending order.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication#NativeSPApplication-BasicConfigurationVersion24andAbove

You probably just need to change your application to use REMOTE_USER instead of "uid" or "eppn".  REMOTE_USER is a special, protected variable, so if this is Tomcat via Apache over AJP, e.g. mod_proxy_ajp or mod_jk, you may need to set tomcatAuthentication="false" in Tomcat's server.xml to get that variable into your application.

http://tomcat.apache.org/tomcat-6.0-doc/config/ajp.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121009/cbfb4f93/attachment.html