RemoteAuth SSO issue

[Losen, Stephen C. (scl)]

Hi folks,

I am running IDP 3.2.1 using RemoteAuth for authentication.  I use Jetty for the IDP and I use Apache httpd as a HTTP reverse proxy for Jetty.  I pass REMOTE_USER to the IDP in a HTTP header.

I have run into a problem that is upstream from jetty/IDP.  Normally when a user fails to login to the SSO system, he gets redirected back to the SSO login server. Under no circumstances should httpd proxy an unauthenticated request (REMOTE_USER not set) to /idp/Authn/RemoteUser.

Unfortunately, something is amiss with our SSO httpd module (mod_pubcookie, I am embarrassed to say) possibly a bad interaction with mod_proxy.  I noticed in our IDP logs that fairly often an unauthenticated request passes through and httpd sets the REMOTE_USER header to "(null)". This should "never" happen, but the IDP logs don't lie.  I have since configured httpd to initialize the REMOTE_USER HTTP header to "unknown-user" and later the SSO module sets it to the authenticated user. I regularly see in the IDP logs "External authentication succeeded for user: unknown-user".  The IDP then does a LDAP lookup that fails, so the IDP releases no attributes in the SAML response.  As far as I can tell, this prevents access to any SPs (I hope).  But this is obviously a terrible situation.  

I have spent quite a bit of time trying to diagnose the problem with no luck.  I haven't been able to reproduce it, although it happens pretty often according to the IDP logs.  And sometimes it leads to looping where I think the browser bounces back and forth between the SP and IDP.

Since I cannot figure out the root cause, I need a band-aid. I would like to configure the IDP to detect and deal with this "unknown-user" situation more gracefully and securely.  Can I configure the IDP to respond to the browser with an error message when the user is "unknown-user" ?  That should halt authentication and prevent any looping. Any pointers to documentation for doing this?  Any other suggestions?

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640