REMOTE_USER authentication

[Roman CHRENKO]

Hello.

Is it possible to login to IDP 3.2.1 (=get shib_idp_session) without sending username/password, only by sending some HTTP header (REMOTE_USER)? If yes, how?



When there is in my idp.properties "idp.authn.flows= Password" (and the client is my browser, or my Java program), everything works fine. When I change it to "idp.authn.flows=RemoteUser", I received SAMLResponse with Status "AuthnFailed":

<saml2p:Status>

        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">

                 <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>

        </saml2p:StatusCode>

        <saml2p:StatusMessage>authn</saml2p:StatusMessage>

</saml2p:Status>

There is in idp-process.log:

2016-08-31 17:34:08,081 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:130] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/RemoteUser to intermediate set

2016-08-31 17:34:08,082 - ERROR [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:296] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication will fail

When I am trying to authenticate by HTTP header REMOTE_USER, I use my browser with Fiddler proxy (with option Rules > Automatic breakpoints > Before Request and I add manually HTTP header "REMOTE_USER: rchrenko" to every request) or I use my Java program, which do the same.

My IDP is installed on Tomcat 8.5.3. Tomcat performs no authentication for "/idp" context.



Thank you,

Roman

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160831/5e54f4f6/attachment.html>