Reverse proxy/ADFS/REMOTE_USER

[Jason Gauthier]

All,

  Hopefully I do an acceptable job explaining my scenario.  I have a configuration that has been working to my liking for some time.
In short, on a single system, Apache serving up applications protected by shibboleth. Those applications use "web authentication" and basically rely on REMOTE_USER for access control.

I decided to pull apache+shib to a reverse proxy frontend. Authentication works, but REMOTE_USER never gets sent to the application now (which is still behind apache).

I fought with this for a while thinking it was apache, and finally broke down and tested this with Apache's basic authentication.  REMOTE_USER was sent to the backend.
And the applications were satisfied.

So, I'm back to scratching my head.  It seems that when I am protecting content with Shib, REMOTE_USER doesn't get sent to the backend apache server.
I can tweak about 3 lines in Apache to back and forth between basic and shib.

I am using ADFS as my IDP, and Shib is acting as an SDP in this case.    I'm not sure where the issues is, and this setup is not a strength, so I am not sure where to even begin.

Thanks very much,

Jason
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131216/06579eaf/attachment.html