Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5

[Koeritz, Chris (cak0l)]

Hi Scott,
We don’t have a web.xml file at all.  I deleted it since the docs seemed to indicate it was no longer needed and could cause issues.  I have tried using the web.xml from the dist directory also, but that made no difference.  I’m currently running with no web.xml again (and have rebuilt the war file).
There is also no remoteuser-authn-config.xml file currently, since that also has been documented as unnecessary.
We used to have code in general-authn.xml defining an authn/RemoteUser bean, but that has been commented out.
Our configuration has been upgraded since at least IdP v3, so it’s more complex than a vanilla install, but I think the above steps should have removed any interfering RemoteUser config.  In addition, I no longer see the “Replacing auto-wired component: authn/RemoteUser” in the log, which should imply that we are using the auto-wired version.
Are there any positive steps we need to take when switching over to the auto-wired configuration?  When the upgrade was performed, the above steps hadn’t been taken yet, and I don’t know if we’re missing something that activates the newer default RemoteUser.  Other beans are still coming from the old style config files, and I’m not sure if something could interfere with the RemoteUser configuration that way.
Ahhh crud.  I think I just found the problem.
Our upgraded configuration did not define idp.searchForProperties, so they were not automatically sought out.  And I had not added the /conf/authn/authn.properties to the list of idp.additionalProperties.  Argh.
After adding that file to the list of additional properties, the certificate-based login is working now.  Imagine that.
Alright, I think this issue is solved, and embarrassingly enough, it was totally simple.
Thanks for your assistance in helping me track down the problem.  Not sure if anyone else would trip up this way, but at least now there’s a thread about it.  Dang.
Thanks,
Chris

--
Chris Koeritz
Senior Linux and Storage Engineer
University of Virginia ITS - Backup, Storage, and Archive Services
P: 434 982 4690



From: Cantor, Scott <cantor.2 at osu.edu>
Date: Tuesday, July 23, 2024 at 10:53 AM
To: Shib Users <users at shibboleth.net>
Cc: Koeritz, Chris (cak0l) <cak0l at virginia.edu>
Subject: Re: Question about Shibboleth IdP v5 with Jetty 12 and extra RemoteUser headers for TLS termination by F5
> Does anything come to mind about why the RemoteUser
> servlet isn’t scooping that up?

Yes, your configuration isn't what you think it is. The snippet you posted shows the right property set,  but it's simply not. Cranking up logging will log all the properties set during startup, generally in the container log, and should also warn about duplicates.

Also see if there's content in web.xml from the old days configuring the servlet that might be interfering with the use of a property.

-- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240723/834e6e3b/attachment.htm>