[Nav-users] REMOTE_USER / Shibboleth SSO login silently fails to pass forward parameters right

21 Aug 2026

      Hi,

We have a problem in authentication with shibboleth (SSO) and nav, which we would like to know if there is any resolution for.
The authenticated user is  seen in Apache variables but not passed to nav.
This is not a Shibboleth, Apache, or `webfront.conf` configuration problem.
It is a code defect probably introduced in 5.17.0 and probably still present, unchanged, in
5.19.0 (latest at time of writing).
It might be a known bug (resolved?) but still present.

It seems to be some shortcomings in the code in
file (`/opt/venvs/nav/lib/python3.13/site-packages/nav/web/auth/backends.py`)
...
import logging
from django.contrib.auth.backends import RemoteUserBackend
from nav.auditlog.models import LogEntry
from nav.web.auth import remote_user
_logger = logging.getLogger(__name__)
class NAVRemoteUserBackend(RemoteUserBackend):
    "An adaptation of Django's RemoteUserBackend that is configurable the NAV way"
    def __init__(self):
        self.create_unknown_user = remote_user.CONFIG.will_autocreate_user()
    def authenticate(self, request, user):
        if not remote_user.CONFIG.is_remote_user_enabled():
            return None
        user = super().authenticate(request, user)
        return user

With DEBUG logging enabled for `nav.web.auth, we see that web-server side is fully functional.
...
request.META["REMOTE_USER"]: "user@xxx.yyy"
[INFO] nav.web.auth.signals] failed login: None
REMOTE_USER: "default" from "/navlets/get-user-navlet/12?mode=VIEW"
...

`REMOTE_USER` is present and correct in `request.META`, confirming the
web-server side is fully functional. The subsequent `failed login: None`
and fallback to the `default` (anonymous) account confirm the failure
occurs entirely inside NAV's Django authentication backend dispatch.

Auto creating accounts does not work, since the remote_user is not passed along right.

## Steps to reproduce

1. Deploy NAV 5.19.0 behind Apache + Shibboleth SP, with
   `webfront.conf`:
...
   [remote-user]
   enabled = yes
   varname = REMOTE_USER
   autocreate = yes

2. Log in via the IdP. Shibboleth authenticates successfully and Apache
   passes `REMOTE_USER` correctly (verified independently via
   `LogFormat "... REMOTE_USER=%u" ...` / `%{REMOTE_USER}e` in Apache access
   logs — confirms the header reaches Apache/mod_wsgi).
3. NAV does not log the user in; the session remains bound to the
   anonymous/`default` account.

Is there any suggested solution?

Kejvan Redjamand

www.chalmers.se<http://www.chalmers.se/>