RemoteUserInternal

[n614cd at gmail.com]

Scott,

I will only have one exposed URI Context which would be the IdP Initiated SSO, passing in the REMOTE_USER header (I can provide the details of how this protected if curious).

I went back through the documentation; and I think I am missing something basic. When hitting /idp/profile/SAML2/Unsolicited/SSO?providerId=XXXXX  I get a 400 error message: Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: Inbound AuthnRequest was required to be signed but was not

Assuming I follow the flow correctly, I have RemoteUserInternal enabled as the only Authn flow. If I have an invalid providerid in the URL, I get an error. So I know the system is processing that much.

Tim

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Tuesday, June 25, 2024 4:11 PM
To: Shib Users <users at shibboleth.net>
Cc: Timothy Spear <n614cd at gmail.com>
Subject: Re: RemoteUserInternal

You don't access that URL directly, it's handled within the sequence of redirects the IdP creates.

IdP initiated SSO does not start there, it works as documented.

Also, that's *not* RemoteUserInternal, that's RemoteUser. The RemoteUserInternal flow requires that all traffic into the IdP has already been authenticated so that REMOTE_USER is just "there", already. The RemoteUser flow uses the servlet, and redirects there during authentication so that only that URL has to be externally protected.

-- Scott