REMOTE_USER authentication

[Cantor, Scott]

> 2. The documentation is really wrong. If you look at Tomcat source code,
> servletRequest.getRemoteUser() returns Principal.getName(). And
> Principal.name is not filled up with CGI variable REMOTE_USER, because
> there are no CGI variables in Tomcat. For example if you use basic
> authentication, look at BasicAuthenticator.java/method authenticate() -
> username is derived from HTTP header "authorization:" and this String is
> directly used for constructing Principal.

That was the distinction I was attempting to make by talking about REMOTE_USER and not getRemoteUser(). It's not derived from a header unless you install a filter to manipulate where it comes from, which is a conscious decision. Out of the box, it's never going to be from a header. It's the identity for the request established by the web server. That's all I'm talking about. It's a shorthand that you apparently have a major point of contention over.

> 4. You wrote " REMOTE_USER is not a header". Can you please tell me (in
> Java world) - what type of object "REMOTE_USER" is?

The REMOTE_USER CGI variable represents the web server's established identify for the request. It's an abstraction that has that specific name in CGI and means the same thing in every other development language that exposes it, which Java happens to expose in the servlet API *in addition to* exposing it as REMOTE_USER when CGI is actually used (and yes, I happen to use CGI, routinely).

>  I suggested to remove everything after "instead", because there is no
> "REMOTE_USER" check in the source code.

Talking about getRemoteUser() is *not* the right point to make, because with a filter you can subvert that by turning it into something other than what it's supposed to mean. That's the distinction the documentation is trying to get at.

-- Scott