Nav-users

Download

nav-users@lister.sikt.no

August 2026

3 participants
1 discussions

REMOTE_USER / Shibboleth SSO login silently fails to pass forward parameters right
by Kejvan Redjamand 02 Sep '26

02 Sep '26

Hi, We have a problem in authentication with shibboleth (SSO) and nav, which we would like to know if there is any resolution for. The authenticated user is seen in Apache variables but not passed to nav. This is not a Shibboleth, Apache, or `webfront.conf` configuration problem. It is a code defect probably introduced in 5.17.0 and probably still present, unchanged, in 5.19.0 (latest at time of writing). It might be a known bug (resolved?) but still present. It seems to be some shortcomings in the code in file (`/opt/venvs/nav/lib/python3.13/site-packages/nav/web/auth/backends.py`) ... import logging from django.contrib.auth.backends import RemoteUserBackend from nav.auditlog.models import LogEntry from nav.web.auth import remote_user _logger = logging.getLogger(__name__) class NAVRemoteUserBackend(RemoteUserBackend): "An adaptation of Django's RemoteUserBackend that is configurable the NAV way" def __init__(self): self.create_unknown_user = remote_user.CONFIG.will_autocreate_user() def authenticate(self, request, user): if not remote_user.CONFIG.is_remote_user_enabled(): return None user = super().authenticate(request, user) return user With DEBUG logging enabled for `nav.web.auth, we see that web-server side is fully functional. ... request.META["REMOTE_USER"]: "user(a)xxx.yyy" [INFO] nav.web.auth.signals] failed login: None REMOTE_USER: "default" from "/navlets/get-user-navlet/12?mode=VIEW" ... `REMOTE_USER` is present and correct in `request.META`, confirming the web-server side is fully functional. The subsequent `failed login: None` and fallback to the `default` (anonymous) account confirm the failure occurs entirely inside NAV's Django authentication backend dispatch. Auto creating accounts does not work, since the remote_user is not passed along right. ## Steps to reproduce 1. Deploy NAV 5.19.0 behind Apache + Shibboleth SP, with `webfront.conf`: ... [remote-user] enabled = yes varname = REMOTE_USER autocreate = yes 2. Log in via the IdP. Shibboleth authenticates successfully and Apache passes `REMOTE_USER` correctly (verified independently via `LogFormat "... REMOTE_USER=%u" ...` / `%{REMOTE_USER}e` in Apache access logs — confirms the header reaches Apache/mod_wsgi). 3. NAV does not log the user in; the session remains bound to the anonymous/`default` account. Is there any suggested solution? Kejvan Redjamand www.chalmers.se<http://www.chalmers.se/>

3 5