Configuring RemoteUser checkHeaders in IDP3

[Tom Zeller]

> On Jul 13, 2016, at 12:47 PM, Rich Graves <rgraves at carleton.edu> wrote:
> 
> We're trying to make the Remoteuser servlet trust an externally provided HTTP header. I must be missing something really simple.
> 
> First I edited the fairly clear conf/authn/remoteuser-internal-authn-config.xml
> 
>     <util:constant id="shibboleth.authn.RemoteUser.checkRemoteUser" static-field="java.lang.Boolean.FALSE"/>
>     <util:list id="shibboleth.authn.RemoteUser.checkHeaders">
>         <value>X-REMOTE-USER</value>
>     </util:list>
> 
> But that didn't seem to do anything. Am I wrong to expect that X-REMOTE-USER should appear in square brackets below?

That configuration file is for RemoteUserInternal, not RemoteUser.

> 
> 2016-07-13 12:39:00,021 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers []
> 
> Then following hints in the (older?) https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration, I edited web.xml directly and rebuilt idp.war including this:
> 
>     <servlet>
>         <servlet-name>RemoteUserAuthHandler</servlet-name>
>         <servlet-class>net.shibboleth.idp.authn.impl.RemoteUserAuthServlet</servlet-class>
>         <load-on-startup>2</load-on-startup>
>     <context-param>
>         <param-name>checkHeaders</param-name>
>         <param-value>X-REMOTE-USER</param-value>
>     </context-param>
> 
> That didn't work either. What does?

    <!-- Servlet protected by container used for RemoteUser authentication -->
    <servlet>
        <servlet-name>RemoteUserAuthHandler</servlet-name>
        <servlet-class>net.shibboleth.idp.authn.impl.RemoteUserAuthServlet</servlet-class>
        <init-param>
            <param-name>checkHeaders</param-name>
            <param-value>X-REMOTE-USER</param-value>
        </init-param>
        <load-on-startup>2</load-on-startup>
    </servlet>

HTH,
Tom