Jetty + REMOTE_USER

[Cantor, Scott]

On 9/10/15, 8:35 AM, "users on behalf of Matthew Slowe" <users-bounces at shibboleth.net on behalf of m.slowe at kent.ac.uk> wrote:



>I've mostly got it working however despite following the "Offloading
>TLS" instructions [1], I can't persuade the IDP to pick up
>the REMOTE[-_]USER header passed back by mod_proxy (I can see it going
>on a tcpdump -A).

I wouldn't send a header with that name (it's just confusing) and separately from that, I don't know how you're trying to pick it up. You certainly can't just leave things defaulting to reading REMOTE_USER. That's not a header. You have to actually specify a header name to read from in the configuration of that login flow (in V3 anyway). That's just the trade-off with the mod_proxy_http approach.

>In Tomcat land I would have set the tomcatAuth=false but can't see what
>to do with Jetty instead.

Nothing. You're equating use of REMOTE_USER with use of a header, they're not all the same.

>Would it be better to just run with the v3 IDP instead?

If you're not running with V3 to begin with, I don't recall if V2's RemoteUser handler could read from headers off hand.

-- Scott