RemoteUserInternalAuthnConfiguration

Current File(s): conf/authn/authn.properties
Format: Properties, Native Spring

Overview

The authn/RemoteUserInternal login flow relies on whatever container-based mechanism you have available (HTTP BASIC auth, LDAP, Kerberos, other SSO systems, etc.). It is particularly friendly to non-browser profiles such as ECP. By default, this flow is configured without support for advanced authentication controls like passive or forced authentication.

The difference between this flow and the RemoteUser flow is that this flow doesn't redirect to a protected path; rather, the path of the requested profile flow has to be protected, which will trigger as soon as the client makes its first request. This is primarily suited to the use of basic-authentication and non-browser clients, though of course this will depend on the exact mechanism involved. Using an external SSO mechanism is likely to be incompatible with non-browser clients.

The main disadvantage of using this flow for browser use cases is that it will perform the request for authentication without having a chance to determine if the request will succeed, which may be undesirable from a usability perspective.

General Configuration

Simple echoing of the extracted REMOTE_USER value requires no special settings. Other simple options are available using authn/authn.properties, many of which parallel the RemoteUser flow’s options), and some more advanced cases will require defining beans, which can be done in global.xml or an imported file.

Note for Upgraded Systems

The old file conf/authn/remoteuser-internal-authn-config.xml is now supported only for compatibility and generally not installed or needed going forward. In the rare case that beans may be needed, they can be defined in global.xml.

Reference

The following beans may be defined in global.xml:

Bean ID

Type

Description

Bean ID

Type

Description

shibboleth.authn.RemoteUserInternal.Transforms

List<Pair<String,String>>

Pairs of regular expressions and replacement expressions to apply to the username

shibboleth.authn.RemoteUserInternal.resultCachingPredicate

Predicate<ProfileRequestContext>

An optional bean that can be defined to control whether to preserve the authentication result in an IdP session

shibboleth.authn.RemoteUserInternal.ClassifiedMessageMap

Map<String,Collection<String>>

Optional remapping of exception messages or events into specific Spring Web Flow events.

The flow-specific properties usable via authn/authn.properties are:

Name

Default