/
RemoteUserInternalAuthnConfiguration

The Shibboleth IdP V4 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP5 wiki space for current documentation on the supported version.

RemoteUserInternalAuthnConfiguration

Current File(s): conf/authn/remoteuser-internal-authn-config.xml, conf/authn/authn.properties (V4.1+)
Format: Native Spring, Properties (V4.1+)

Overview

The authn/RemoteUserInternal login flow relies on whatever container-based mechanism you have available (HTTP BASIC auth, LDAP, Kerberos, other SSO systems, etc.). It is particularly friendly to non-browser profiles such as ECP. By default, this flow is configured without support for advanced authentication controls like passive or forced authentication.

The difference between this flow and the RemoteUser flow is that this flow doesn't redirect to a protected path; rather, the path of the requested profile flow has to be protected, which will trigger as soon as the client makes its first request. This is primarily suited to the use of basic-authentication and non-browser clients, though of course this will depend on the exact mechanism involved. Using a second SSO mechanism is likely to be incompatible with non-browser clients.

The main disadvantage of using this flow for browser use cases is that it will perform the request for authentication without having a chance to determine if the request will succeed, which may be undesirable from a usability perspective.

Enabling Module (V4.1+)

For V4.1+, configuring and using this feature requires that you first enable the "RemoteUserInternal" module if it isn't already enabled. Systems upgraded from older releases generally come pre-enabled due to the prior state of the configuration tree.

(Windows) C:\opt\shibboleth-idp> bin\module.bat -t RemoteUserInternal || bin\module.bat -e RemoteUserInternal (Other) $ bin/module.sh -t RemoteUserInternal || bin/module.sh -e RemoteUserInternal

General Configuration

Use authn/remoteuser-internal-authn-config.xml to configure this flow. Various beans are defined to control how the user identity is extracted from the HTTP request, various transforms to perform on the resulting name prior to final evaluation, and rules for evaluating the name, such as allow/deny lists, or a matching expression. Simple echoing of the extracted REMOTE_USER value requires no changes. See the reference below for a complete list.

Simple echoing of the extracted REMOTE_USER value requires no special settings. Other simple options are available using authn/authn.properties, and some more advanced cases will require defining/adjusting bean definitions in authn/remoteuser-internal-authn-config.xml

Reference

The following beans are defined, or expected to be defined in, authn/remoteuser-internal-authn-config.xml:

Bean ID

Type

Default

Description

Bean ID

Type

Default

Description

shibboleth.authn.RemoteUser.checkRemoteUser

Boolean

true

Whether to check REMOTE_USER for a username

shibboleth.authn.RemoteUser.checkAttributes

List<String>



A list of servlet request attributes to check for a username

shibboleth.authn.RemoteUser.checkHeaders

List<String>



A list of request headers to check for a username

shibboleth.authn.RemoteUser.Lowercase

Boolean

false

Whether to lowercase the username

shibboleth.authn.RemoteUser.Uppercase

Boolean

false

Whether to uppercase the username

shibboleth.authn.RemoteUser.Trim

Boolean

true

Whether to trim leading and trailing whitespace from the username

shibboleth.authn.RemoteUser.Transforms

List<Pair<String,String>>



Pairs of regular expressions and replacement expressions to apply to the username

shibboleth.authn.RemoteUser.whitelistedUsernames

List<String>



A list of usernames to accept (blocking all others)

shibboleth.authn.RemoteUser.blacklistedUsernames

List<String>



A list of usernames to reject (accepting all others)

shibboleth.authn.RemoteUser.matchExpression

Pattern



A regular expression that must match the username

shibboleth.authn.RemoteUser.resultCachingPredicate

Predicate<ProfileRequestContext>



An optional bean that can be defined to control whether to preserve the authentication result in an IdP session

shibboleth.authn.RemoteUser.addDefaultPrincipals

Boolean

true

Whether to add the content of the supportedPrincipals property of the underlying flow descriptor to the resulting Subject

The following beans are defined, or expected to be defined in, authn/remoteuser-internal-authn-config.xml:

Bean ID

Type

Description

Bean ID

Type

Description

shibboleth.authn.RemoteUser.Transforms

List<Pair<String,String>>

Pairs of regular expressions and replacement expressions to apply to the username

shibboleth.authn.RemoteUser.resultCachingPredicate

Predicate<ProfileRequestContext>

An optional bean that can be defined to control whether to preserve the authentication result in an IdP session

The flow-specific properties usable via authn/authn.properties are:

Name

Default

Description