authn/MFA and authn/RemoteUser with two flavors of client certs

[Cantor, Scott]

On 6/14/18, 6:18 PM, "users on behalf of Losen, Stephen C. (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> Looking at the documentation for authn/RemoteUser I see that it supports a "servlet init parameter" called
> "authnMethodHeader"  I think this is just what I need. I am using httpd as a reverse proxy so I can define a request
> header named something like "X-Auth-Method".  Httpd can inspect the client cert issuer and if the client cert is a token,
> then pass our "enhanced" auth method value via the X-Auth-Method header.  Otherwise not.
>
> Am I correct that this the purpose of the "authnMethodHeader" feature?

Correct. What it specifically does is interrogate the flow descriptor bean with the supportedPrincipals property and look through that collection and if it finds a simple string match between the header value and one of those Principals, it will stuff that into the Subject.
 
Make sure you set the shibboleth.authn.RemoteUser.addDefaultPrincipals bean to false to avoid it just adding everything anyway, you're taking control of that decision if you use the header.

-- Scott