<div dir="ltr"><div>We're trying to make the Remoteuser servlet trust an externally provided HTTP header. I must be missing something really simple.</div><div><br></div><div>First I edited the fairly clear conf/authn/remoteuser-internal-authn-config.xml</div><div><br></div><div><div>    <util:constant id="shibboleth.authn.RemoteUser.checkRemoteUser" static-field="java.lang.Boolean.FALSE"/></div></div><div><div>    <util:list id="shibboleth.authn.RemoteUser.checkHeaders"></div><div>        <value>X-REMOTE-USER</value><br></div><div>    </util:list></div></div><div><br></div><div>But that didn't seem to do anything. Am I wrong to expect that X-REMOTE-USER should appear in square brackets below?</div><div><br></div><div><div>2016-07-13 12:39:00,021 - INFO [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:193] - RemoteUserAuthServlet will process REMOTE_USER, along with attributes [] and headers []</div></div><div><br></div><div>Then following hints in the (older?) <a href="https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration</a>, I edited web.xml directly and rebuilt idp.war including this:</div><div><br></div><div><div>    <servlet></div><div>        <servlet-name>RemoteUserAuthHandler</servlet-name></div><div>        <servlet-class>net.shibboleth.idp.authn.impl.RemoteUserAuthServlet</servlet-class></div><div>        <load-on-startup>2</load-on-startup></div><div>    <context-param></div><div>        <param-name>checkHeaders</param-name></div><div>        <param-value>X-REMOTE-USER</param-value></div><div>    </context-param></div></div><div><br></div><div>That didn't work either. What does?</div></div>