REMOTE_USER authentication

[Roman CHRENKO]

Hello.
Thanks Scott. Your email was inspiring (although not completely right, because REMOTE_USER generally could be also a httpRequest's header or parameter, not only attribute).
I found the solution (by analyzing the net.shibboleth.idp.authn.impl.RemoteUserAuthServlet's source code).

conf/authn/remoteuser-authn-config.xml:
        <bean id="shibboleth.authn.RemoteUser.externalAuthnPath" class="java.lang.String" c:_0="contextRelative:Authn/RemoteUser" />
        So, I needed to find the servlet, which is mapped to the context /Authn/RemoteUser. It is defined in web.xml.

webapp/WEB-INF/web.xml:
        <servlet>
                <servlet-name>RemoteUserAuthHandler</servlet-name>
                <servlet-class>net.shibboleth.idp.authn.impl.RemoteUserAuthServlet</servlet-class>
                <load-on-startup>2</load-on-startup>
        </servlet>
        <servlet-mapping>
                <servlet-name>RemoteUserAuthHandler</servlet-name>
                <url-pattern>/Authn/RemoteUser</url-pattern>
        </servlet-mapping>
        So, I found the right servlet name and could get the source code. By examining the source code I now undestand how it works, where are errors in documentation and how to solve the problem.

The documentation at https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration is wrong. It says:
checkRemoteUser (true or false): whether to look for a principal name in REMOTE_USER
        This is the first error (I should say "confusion"), because the source code shows that it only check httpRequest.getRemoteUser(), so no REMOTE_USER.
        REMOTE_USER can be (in general) httpRequest's attribute, parameter or header.
        The documentation should rather state: checkRemoteUser (true or false): whether to look for a principal name by httpRequest.getRemoteUser(). Such statement is precise and not confusing.
checkHeaders (list of space-delimited request header names): servlet request header(s) to search for a principal name, instead of or in addition to REMOTE_USER
        This is the second error, because the souce code shows that it doesn't check "REMOTE_USER" header. You must define it manually in web.xml.
        The documentation should state: checkHeaders (list of space-delimited request header names): servlet request header(s) to search for a principal name

Then the solution is easy - add the init-param to the servlet:
    <servlet>
        <servlet-name>RemoteUserAuthHandler</servlet-name>
        <servlet-class>net.shibboleth.idp.authn.impl.RemoteUserAuthServlet</servlet-class>
        <init-param>
            <param-name>checkHeaders</param-name>
            <param-value>REMOTE_USER</param-value>
        </init-param>
        <load-on-startup>2</load-on-startup>
    </servlet>

There was (in my implementation) no need to customize /opt/shibboleth-idp/conf/authn/remoteuser-authn-config.xml nor /opt/shibboleth-idp/conf/authn/general-authn.xml.

Roman




-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 31, 2016 6:16 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: REMOTE_USER authentication

On 8/31/16, 12:00 PM, "users on behalf of Roman CHRENKO" <users-bounces at shibboleth.net on behalf of Roman_CHRENKO at tempest.sk> wrote:

> When I am trying to authenticate by HTTP header REMOTE_USER, I use my
> browser with Fiddler proxy (with option Rules > Automatic breakpoints
> > Before Request and I add manually HTTP header "REMOTE_USER:
> rchrenko" to every request) or I use my Java program, which do the same.

REMOTE_USER is not a header. If you want to use a header, then you have to follow the documentation and change the configuration to look for the identity in a header, and I certainly would not confuse yourself by calling it REMOTE_USER.

The servlet API for getRemoteUser will only return a value established by the container, not from a header just because you happen to call it that.

-- Scott




--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net