RemoteUserInternal

[Timothy Spear]

I am still getting a 302 redirect when I use the Unsolicited SSO Flow. My
goal is treat the request like an ECP login.
Note: I am using an Apache to mask the URI context. The request is coming
over /legacyapp and using AJP connection sending to Tomcat on /idp where
Shibboleth is installed.
Is this allowed? Or does Shibboleth intentionally block this?

My Authn settings are fairly basic:

idp.authn.flows=RemoteUserInternal

idp.authn.RemoteUserInternal.nonBrowserSupported=true
idp.authn.RemoteUserInternal.addDefaultPrincipals=true
idp.authn.RemoteUserInternal.checkRemoteUser=true
idp.authn.RemoteUserInternal.proxyRestrictionsEnforced=false

---------------------------------
What am I missing?

Note: the /legacyapp is so I can more easily control by each legacy app the
specific access controls and integration. Much easier than having
everything under /idp.

Tim

On Thu, Jun 27, 2024 at 12:16 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > The reason I picked the RemoteUserInternal was to reduce
> > browser bounce. Since I know the path of the users entering
> > the system.
>
> Fair, reducing the "bounce" was really the only point to it, so that's
> what it's for.
>
> -- Scott
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240708/f1362018/attachment.htm>