REMOTE_USER authentication

[Cantor, Scott]

On 8/31/16, 12:00 PM, "users on behalf of Roman CHRENKO" <users-bounces at shibboleth.net on behalf of Roman_CHRENKO at tempest.sk> wrote:

> When I am trying to authenticate by HTTP header REMOTE_USER, I use my browser with Fiddler
> proxy (with option Rules > Automatic breakpoints > Before Request and I add manually HTTP
> header "REMOTE_USER: rchrenko" to every request) or I use my Java program, which do the
> same.

REMOTE_USER is not a header. If you want to use a header, then you have to follow the documentation and change the configuration to look for the identity in a header, and I certainly would not confuse yourself by calling it REMOTE_USER.

The servlet API for getRemoteUser will only return a value established by the container, not from a header just because you happen to call it that.

-- Scott