idP 3.1.1 : Spring security custom auth and the RemoteUser flow

[Camel Guy]

The solution is to wrap the request (prior to forward) and overload
addHeader and getRemoteUser. Relevant code is at:

http://pastebin.com/29PbiFAL

 I welcome direct email.


~cg

On Tue, Jun 9, 2015 at 6:45 PM, Camel Guy <camel at devguy.com> wrote:

> Hello,
>
> I am running Shibboleth idP 3.1.1 on Jetty 9.2.
>
> I was able to get RemoteUser working with Spring Security with basic
> authentication. Filled with hubris, I decided to implement a custom
> authentication.
>
> The particular authentication I'm implementing is not interactive, unless
> it fails.
>
> I now have a complex mess of code that follows this approach:
>
>
> http://javattitude.com/2014/06/07/spring-security-custom-token-based-rest-authentication/
>
> The problem is, from the log:
>
> 2015-06-09 15:53:29,489 - DEBUG
> [com.identityoverip.springauth.ise.ISEAuthenticationFilter:317] -
> Authentication success. Updating SecurityContextHolder to contain:
> org.springframework.security.authentication.UsernamePasswordAuthenticationToken at be648917:
> Principal: admin; Credentials: [PROTECTED]; Authenticated: true; Details: ..
>
> So, the security context was created successfully.
>
> Then onAuthenticationSuccess() forwards to /Authn/RemoteUser.
>
> But RemoteUser is having none of it:
>
> 2015-06-09 15:53:29,655 - INFO
> [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:121] -
> Profile Action ValidateExternalAuthentication: External authentication
> failed, no user identity or error information returned
>
> I've tried many things:
>
> 1. Add REMOTE_USER header in the request prior to calling forward -
> containing only 'admin'
> 2. Remove create-session='stateless' from <http>
>
> Not to overwhelm you with a ton of information (yet), my <http> entry
> looks like:
>
> <http entry-point-ref="authenticationEntryPoint" use-expressions="true"
> auto-config="false" >    <custom-filter
> ref="authenticationTokenProcessingFilter" position="FORM_LOGIN_FILTER"   />
>  <intercept-url pattern="/Authn/RemoteUser/**" access="isAuthenticated()" />
>  <logout />
> </http>
>
> The number of fixes I've attempted is in the hundreds. The outcome is
> always the same: External authentication failed, no user identity or error
> information returned.
>
> Perhaps I need to configure RemoteUser to look for something other than
> the REMOTE_USER header.
>
> If there are no suggestions, I suppose I'd better learn how to use the
> External flow. Spring MVC/flows is new to me and a custom authenticator
> seemed easier.
>
>
> Thank you,
>
> cg
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150610/07d0c5dd/attachment.html>