IdPv3 - RemoteUserInternal and logging query

[Cantor, Scott]

On 3/18/16, 12:57 PM, "users on behalf of John Horne" <users-bounces at shibboleth.net on behalf of john.horne at plymouth.ac.uk> wrote:



>Hello,
>
>In the 'conf/idp.properties' file I have set:
>
>    idp.authn.flows=RemoteUserInternal

Bear in mind that RemoteUserInternal means you need to protect the entire profile path, so the user will be challenged before ever starting the SAML processing, meaning they might get hit with a login, and then end up with an error if something goes wrong early.

In practice, I would not really expect anybody to use it. It was done before I understood the issues here, and that's why it got renamed and the "RemoteUser" name was assigned to the one I figured people would actually want to use.

>so that request headers will be checked (as well as REMOTE_USER).
>However, in the log file it still logs:

That servlet is for RemoteUser, not RemoteUserInternal. I agree it's confusing. If you don't want the servlet and don't use it, yank it from web.xml if you like.

-- Scott

>