Configuring RemoteUser checkHeaders in IDP3

[Rich Graves]

We're trying to make the Remoteuser servlet trust an externally provided
HTTP header. I must be missing something really simple.

First I edited the fairly clear
conf/authn/remoteuser-internal-authn-config.xml

    <util:constant id="shibboleth.authn.RemoteUser.checkRemoteUser"
static-field="java.lang.Boolean.FALSE"/>
    <util:list id="shibboleth.authn.RemoteUser.checkHeaders">
        <value>X-REMOTE-USER</value>
    </util:list>

But that didn't seem to do anything. Am I wrong to expect
that X-REMOTE-USER should appear in square brackets below?

2016-07-13 12:39:00,021 - INFO
[net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] -
RemoteUserAuthServlet will process REMOTE_USER, along with attributes []
and headers []

Then following hints in the (older?)
https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration,
I edited web.xml directly and rebuilt idp.war including this:

    <servlet>
        <servlet-name>RemoteUserAuthHandler</servlet-name>

<servlet-class>net.shibboleth.idp.authn.impl.RemoteUserAuthServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    <context-param>
        <param-name>checkHeaders</param-name>
        <param-value>X-REMOTE-USER</param-value>
    </context-param>

That didn't work either. What does?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160713/f28eb1dd/attachment.html>