REMOTE_USER authentication

[Cantor, Scott]

On 9/2/16, 5:37 AM, "users on behalf of Roman CHRENKO" <users-bounces at shibboleth.net on behalf of Roman_CHRENKO at tempest.sk> wrote:

> Thanks Scott. Your email was inspiring (although not completely right, because REMOTE_USER
> generally could be also a httpRequest's header or parameter, not only attribute).

No, it cannot. That is not REMOTE_USER. That's a reserved construct of the CGI interface, and can never be pulled from a header. Naming a header HTTP_REMOTE_USER under the covers doesn't turn the header into REMOTE_USER. It does lead to confusion for people later.

> The documentation at https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration is wrong. 

No, it's not.

> It says:
>    checkRemoteUser (true or false): whether to look for a principal name in REMOTE_USER
>            This is the first error (I should say "confusion"), because the source code
> shows that it only check httpRequest.getRemoteUser(), so no REMOTE_USER.

That's what it *means* to check REMOTE_USER.

>            REMOTE_USER can be (in general) httpRequest's attribute, parameter or header.

No, it can't.

>    checkHeaders (list of space-delimited request header names): servlet request header(s)
> to search for a principal name, instead of or in addition to REMOTE_USER
>           This is the second error, because the souce code shows that it doesn't check
> "REMOTE_USER" header. You must define it manually in web.xml.

REMOTE_USER is not a header, and the documentation is *telling* you that if you want it to check a header, you have to define that header name in web.xml.

>            The documentation should state: checkHeaders (list of space-delimited request
> header names): servlet request header(s) to search for a principal name

That's what it says now.

> Then the solution is easy - add the init-param to the servlet:

You're adding a header that *you* named, and leaving a confusing mess for somebody later to come along and misunderstand what it's doing. Do what you like, but I'm telling you after a great deal more experience that using a header named REMOTE_USER is a recipe for confusion. The header name you set doesn't matter, and you shouldn't set headers that conflict with existing CGI interface names.

-- Scott