Jetty + REMOTE_USER

[Cantor, Scott]

On 9/12/15, 2:41 PM, "users on behalf of Matthew Slowe" <users-bounces at shibboleth.net on behalf of m.slowe at kent.ac.uk> wrote:
>
>I assumed, perhaps wrongly, that IDP inside Jetty would work similarly
>to Tomcat where the REMOTE_USER in Apache is passed back via AJP and
>found various hints on the internet to suggest this ought to work.

Used to, then they unfortunately dropped AJP support.

As Jim noted, our general attitude about documenting use of Apache became very negative because its support for client TLS is bad, and they refuse to improve it. Historically, the backchannel was a major issue for us, and supporting people using Apache and trying to handle client TLS for SOAP was fairly painful. Now the back channel isn't such a big deal, but for most deployers the complexity of Apache isn't warranted and it hasn't been the direction of our documentation for many years.

People that want to use Apache with a container are thus expected to be able to handle that portion without any help from us, whichever container that happens to be.

>I was using the REMOTE_USER environment variable in Apache land and
>passing it back as a header to Jetty... unless there's a better way to
>do this?

There is no other way, but as I said, I have no memory of whether V2 supported that.

>> 
>> If you're not running with V3 to begin with, I don't recall if V2's RemoteUser handler could read from headers off hand.
>
>It got it via AJP ok :-)

REMOTE_USER isn't a header so it's not at all equivalent. AJP supports proxying REMOTE_USER. HTTP does not.

-- Scott