RemoteUser configuration in IdP V 3.2.1

[Erik Guss]

I am using CAS for the RemoteUser authn. I looked back at my V2 configs
and listserv historical traffic and found the answer. It was to delegate
all WebSSO to CAS, by disabling sessions entirely in the IdP. This can
now be done (in V3) in idp.properties with idp.session.enabled = false. 


On Fri, 2016-07-08 at 17:13 +0000, Cantor, Scott wrote:
> > A clarification: The RemoteUser is configured in the web.xml, and functions
> > correctly the first time the SP contacts the IdP (not including a session Id).
> > The error log entries I included below are for when the browser has sat idle
> > for more than the IdP session limit, but still submits the IdP session id it has in
> > the request. Since that session has expired, no REMOTE_USER is found. That
> > is when I wish for the IdP to re-run the login flow from scratch (or some
> > other proper way to allow it to get back to a login screen.) Thank you.
> 
> That doesn't change my answer. *You* are in charge of ensuring that the servlet that runs finds an identity where you tell it to look. There is no way for the IdP to do that, it has no involvement.
> 
> You've said nothing about what mechanism you are using to supply the identity, so there's nothing else I'm really in a position to tell you.
> 
> -- Scott
>