JIRA + AJP + REMOTE_USER - how do I get rid of the login screen?

[Graham Leggett]

Hi all,

I am trying to achieve the most brutally simple JIRA/Apache integration possible - Apache httpd provides the username, JIRA uses that username, the end. No user autocreate, no user update (that’s all LDAP based), just pure login.

Having followed the instructions at https://github.com/chauth/jira_http_authenticator to install the net.shibboleth.tools.jira.authn.RemoteUserAuthenticator authenticator (and initially tripping over the wrong package name in the docs, so I am sure this authenticator is being used), I get no difference in behaviour.

I still get the normal JIRA login screen, and the REMOTE_USER provided by Tomcat (via tomcatAuthentication=“false”) is completely ignored, the cursed JIRA login screen still pops up (and works too, forcing the end user to login twice).

Can anyone reveal a clue as to what I may have done wrong?

The remoteUserAuthenticator.properties file is in classes next to seraph-config.xml and looks like this:

local.login.supported=false
create.users=false
update.info=false
update.last.login.date=true
reload.config=false
reload.config.check.interval=5000
default.roles=jira-users
header.remote_user=REMOTE_USER
header.email=CONF_EMAIL
header.fullname=CONF_FULLNAME
username.convertcase=true
update.roles=true
convert.to.utf8=false
dynamicroles.auto_create_role=false
dynamicroles.output.tolowercase=true

local.login.supported was changed from true to false, made no difference. I am interpreting "header.remote_user=REMOTE_USER” to mean “take the remote username from request.getPrincipal()”, is this correct? I am assuming neither header.email nor header.fullname is relevant because create.users and update.info are both false.

Regards,
Graham
—