<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thanks Greg.</div>
<div> "Put an Apache httpd with mod_proxy_http in front with a Shibboleth SP installed”</div>
<div><br>
</div>
<div>That is what I was thinking… But some other R/Shiny link mentioned custom header names (security through obscurity?) and not REMOTE_USER or even their own default header name?</div>
<div><br>
</div>
<div>Thanks for re-affirming I am not yet completely senile. :)</div>
<div><br>
</div>
<div>-Bryan</div>
<div><br>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Greg Haverkamp <<a href="mailto:gahaverkamp@lbl.gov">gahaverkamp@lbl.gov</a>><br>
<span style="font-weight:bold">Reply-To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Monday, June 25, 2018 at 8:24 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>[Ext] Re: R/Shiny integration<br>
</div>
<div><br>
</div>
<div>
<div><span style="font-size:14px; font-weight:bold; color:red; font-family: monospace, sans-serif">******************************************************<br>
WARNING: Stop. Think. Read. This is an external email.<br>
******************************************************<br>
<br>
</span>
<div dir="ltr">
<div class="gmail_quote">
<div dir="ltr">On Mon, Jun 25, 2018 at 7:13 PM Bryan Wooten <<a href="mailto:bryan.wooten@utah.edu">bryan.wooten@utah.edu</a>> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div style="color:rgb(0,0,0);font-family:Calibri,sans-serif;font-size:14px"><font face="Calibri,sans-serif" style="font-size:13px;color:rgb(34,34,34)">"</font><span style="font-family:"Source Sans Pro","Lucida Grande",Verdana,Arial,sans-serif">Proxied authentication
allows these tools to integrate with other Single Sign On (SSO) and Identity Access Management (IAM) tools that are not directly supported.</span><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif" style="font-size:13px;color:rgb(34,34,34)">“</font><br>
</div>
<div><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif"><br>
</font></div>
<div><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif">I</font><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif"> can’t find any direct support for SAML?</font></div>
</div>
</blockquote>
<div><br>
</div>
<div>They wouldn't prescribe a proxy for external authentication if they did direct SAML.</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif"><br>
</font></div>
<div><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif">Any and all pro-tips / insults gladly accepted.</font></div>
<div><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif"><br>
</font></div>
<div><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif">Note: the R/Shiny app is currently doing simple AD authentication, the owners want Duo added. Our Shib/CAS currently supports Duo. So I want to move this R/Shiny app to either CAS or </font><font face="Source Sans Pro,Lucida Grande,Verdana,Arial,sans-serif">Shib
SSO and not direct AD authentication.</font></div>
</div>
</blockquote>
<div><br>
</div>
<div>Put an Apache httpd with mod_proxy_http in front with a Shibboleth SP installed and configured for the proxy location with ShibUserHeaders On (but be sure to read the caveats). Decide which environment variable you're going to have to set the username,
and configure that in the backend server.</div>
<div><br>
</div>
<div>I imagine this can be done with CAS, too; I just haven't ever used it.</div>
<div><br>
</div>
<div>Greg</div>
</div>
</div>
</div>
</div>
</span>
</body>
</html>