RemoteUser authnMethodHeader example?

[Cantor, Scott]

> If I set my authnMethodHeader to include TimeSyncToken, I see...
> 
> 2017-02-07 15:08:49,292 - WARN
> [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:280] -
> xxx.xxx.xxx.xxx - Unable to locate a suitable Principal for authentication
> method from header UMAuthnContext:
> urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken

I assume that's the non-token version basically saying "I can't support the value you're telling me to return". That would be expected, but that's going to be the authentication result there. It's going to finish successfully there.

You can't be getting that log *before* authentication happens, that's part of it running that flow. It actually happens only if the login method succeeds and it would be returning a result and it would be done. It would not continue to check other methods because it's done at that point. That could only be altered if the SP requested something specific.

> Should it have looked at RemoteUserToken?

Without any specific requirements it would try every method, but the first thing you asked about in the log is  evidence of it completing one of those methods.

-- Scott