Set an attribute as REMOTE_USER but don't pass the attribute in the forwarded request

[Nate Klingenstein]

Bradley,

You can name any incoming SAML attribute anything you want in the environment variables, attribute map, and header variables, and map that to REMOTE_USER.  That should avoid the request attribute name clash in the first place.

Just change the id="" in attribute-map.xml on the <Attribute> element in question to something more unique to your environment, and update REMOTE_USER in shibboleth2.xml to match the new ID.

Hope this helps,
Nate.

________________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Bradley Wagner <bradley.wagner at hannonhill.com>
Sent: Thursday, November 07, 2013 0:34
To: users at shibboleth.net
Subject: Set an attribute as REMOTE_USER but don't pass the attribute in the    forwarded request

Is it possible to map an attribute, set it as the REMOTE_USER but then
*not* pass the attribute along in the forwarded request.

We're running into an issue where an attribute that we're passing is
clashing with a request attribute name that we're using elsewhere in
our app.

It would be easy for us to pull it out of REMOTE_USER and at that
point we wouldn't need the attribute's original name in the request at
all.

We're forwarding to our Tomcat app via AJP. Could I just remove the
"AJP_" attribute prefix and prevent the attribute from being passed to
Tomcat?

Apologies if this has been covered. I did some quick searching and
couldn't find an answer.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net