Jetty + REMOTE_USER

[Matthew Slowe]

On Sat, Sep 12, 2015 at 01:17:11AM +0000, Cantor, Scott wrote:
> On 9/10/15, 8:35 AM, "users on behalf of Matthew Slowe" <users-bounces at shibboleth.net on behalf of m.slowe at kent.ac.uk> wrote:
> 
> 
> 
> >I've mostly got it working however despite following the "Offloading
> >TLS" instructions [1], I can't persuade the IDP to pick up
> >the REMOTE[-_]USER header passed back by mod_proxy (I can see it going
> >on a tcpdump -A).
> 
> I wouldn't send a header with that name (it's just confusing) and
> separately from that, I don't know how you're trying to pick it up.
> You certainly can't just leave things defaulting to reading
> REMOTE_USER. That's not a header. You have to actually specify a
> header name to read from in the configuration of that login flow (in
> V3 anyway). That's just the trade-off with the mod_proxy_http
> approach.

I assumed, perhaps wrongly, that IDP inside Jetty would work similarly
to Tomcat where the REMOTE_USER in Apache is passed back via AJP and
found various hints on the internet to suggest this ought to work.

> >In Tomcat land I would have set the tomcatAuth=false but can't see what
> >to do with Jetty instead.
> 
> Nothing. You're equating use of REMOTE_USER with use of a header, they're not all the same.

I was using the REMOTE_USER environment variable in Apache land and
passing it back as a header to Jetty... unless there's a better way to
do this?

> >Would it be better to just run with the v3 IDP instead?
> 
> If you're not running with V3 to begin with, I don't recall if V2's RemoteUser handler could read from headers off hand.

It got it via AJP ok :-)

-- 
Matthew Slowe | Server Infrastructure Officer
IT Infrastructure, Information Services, University of Kent
Room S21, Cornwallis South
Canterbury, Kent, CT2 7NZ, UK
Tel: +44 (0)1227 824265 

www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt
PGP: https://keybase.io/fooflington