RemoteUser authnMethodHeader example?

[Liam Hoekenga]

On Mon, Feb 6, 2017 at 4:39 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> If your flow supports a custom AuthnContextClassPrincipal called "urn:foo"
> then put urn:foo in the header and it will include that in the Subject.
> That's pretty much it.
>

Couldn't someone insert an illicit header on the browser side?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170207/1d5c85cd/attachment.html>