JIRA + AJP + REMOTE_USER - how do I get rid of the login screen?

[Graham Leggett]

On 19 Mar 2015, at 2:57 PM, Graham Leggett <minfrin at sharp.fm> wrote:

> local.login.supported was changed from true to false, made no difference. I am interpreting "header.remote_user=REMOTE_USER” to mean “take the remote username from request.getPrincipal()”, is this correct? I am assuming neither header.email nor header.fullname is relevant because create.users and update.info are both false.

Cracking out the source code, it seems the behaviour I need is only available when header.remote_user is unset:

        if (config.getRemoteUserHeaderName() != null) {
[snip]
        } else {
            remoteUser = unwrapRequestIfNeeded(request).getRemoteUser();
        }

        return remoteUser;

header.remote_user however can never be unset, because when unset it is given a default value:

     config.setRemoteUserHeaderName(configProps.getProperty(ShibAuthConstants.REMOTE_USER_HEADER_NAME_PROPERTY, "REMOTE_USER"));

It seems the fix seems to be to remove the default value:

Index: src/main/java/net/shibboleth/tools/jira/authn/ShibAuthConfigLoader.java
===================================================================
--- src/main/java/net/shibboleth/tools/jira/authn/ShibAuthConfigLoader.java	(revision 2)
+++ src/main/java/net/shibboleth/tools/jira/authn/ShibAuthConfigLoader.java	(working copy)
@@ -154,7 +154,7 @@
             }
 
             config.setDefaultRoles(defaultRoles);
-            config.setRemoteUserHeaderName(configProps.getProperty(ShibAuthConstants.REMOTE_USER_HEADER_NAME_PROPERTY, "REMOTE_USER"));
+            config.setRemoteUserHeaderName(configProps.getProperty(ShibAuthConstants.REMOTE_USER_HEADER_NAME_PROPERTY));
 
             if (log.isDebugEnabled()) {
                 log.debug("HTTP Header that may contain user's username set to: " + config.getRemoteUserHeaderName());

Is this the correct fix or should this be done a different way?

Regards,
Graham
—