REMOTE_USER authentication

[Cantor, Scott]

On 8/31/16, 12:48 PM, "users on behalf of John Dennis" <users-bounces at shibboleth.net on behalf of jdennis at redhat.com> wrote:

>    FWIW it's easy to write a filter that will allow things like
>  getRemoteUser to first check for a value in an HTTP header. I'm happy to
>  share the code.

The IdP handles headers if you need it to, there's no need for a filter, but obviously it has all the same risks.

> [1] The same holds true for AJP proxies that embed REMOTE_USER in the
>  AJP protocol stream (which getRemoteUser will see).

Yes, but unlike HTTP, AJP is explicitly understood to be an insecure protocol that nobody should be running across hosts unless they've taken deliberate steps.

The problem is that security groups today are forcing, urging, cajoling, etc. all sorts of web apps to be operated via HTTP proxying under the guise that it's *better* for security, so this sort of thing is not only becoming the norm, but people are being flagged for not doing it.

I think there's a correlation between the rise of security certifications and the total lack of common sense across the profession.

-- Scott