RemoteUserInternal

[Timothy Spear]

Hi,

Short version. I am attempting to create a flow which would piece together
RemoteUserInternal with UnsolicitedSSO. I get a 404 message when attempting
to use the /idp/Authn/RemoteUserInternal  path.

My authn properties are very basic:

idp.authn.flows=RemoteUserInternal
idp.authn.RemoteUserInternal.nonBrowserSupported=true
idp.authn.RemoteUserInternal.addDefaultPrincipals=true
idp.authn.RemoteUserInternal.checkRemoteUser=true

Background: I am integrating multiple legacy web applications which each
act their own IdP. I am therefore using Apache in front of Shibboleth to
provide this integration making use of the RemoteUserInternal profile.
REMOTE_USER is appended to the header of the request before submission to
Shibboleth (and also removed from any incoming requests first, and sessions
validated). If I go to /idp/Authn/RemoteUser; I get a 500 error on Tomcat
"ExternalAuthenticationException: No conversation key found in request".
Which makes sense, since RemoteUser expects it.

If I go direct to /idp/profile/SAML2/Unsolicited/SSO?providerId=XXXXX  I
get a 400 error message: Profile Action WebFlowMessageHandlerAdaptor:
Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: Inbound
AuthnRequest was required to be signed but was not   Which makes sense
since I am not logged in.

Has anyone managed to get RemoteUserInternal working? I assume I missed
something basic.

Thanks,

Tim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240625/ec8157ef/attachment.htm>