authn/MFA and authn/RemoteUser with two flavors of client certs

[Cantor, Scott]

(And I would have mentioned this header if I'd remembered it, half the point of the documentation is to remind myself of what actually got built.)

-- Scott

On 6/14/18, 8:11 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

On 6/14/18, 6:18 PM, "users on behalf of Losen, Stephen C. (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> Looking at the documentation for authn/RemoteUser I see that it supports a "servlet init parameter" called
> "authnMethodHeader"  I think this is just what I need. I am using httpd as a reverse proxy so I can define a request
> header named something like "X-Auth-Method".  Httpd can inspect the client cert issuer and if the client cert is a token,
> then pass our "enhanced" auth method value via the X-Auth-Method header.  Otherwise not.
>
> Am I correct that this the purpose of the "authnMethodHeader" feature?