Propagate Single Sign-on Using Populate JAAS Subject From Client

Applications use HTTP headers and cookies to pass data that should be used for single sign-on into the back end. The Populate JAAS Subject From Client enables administrators to add named credentials, name principals, and role principals to the authenticated subject.

Adding client values as named credentials allows them to be used for single sign-on. When authenticating the user using a token from the client, if the corresponding authentication provider cannot retrieve the user name from the token and add it as a principal for use in impersonation checking, the administrator can configure this provider to add the appropriate header value from the client session as a principal to the authenticated subject.

Note: Rogue applications can intentionally insert HTTP headers with arbitrary values to obtain principals, roles, or credentials that they otherwise would not receive using the other authentication providers. Use this authentication provider in an environment where you know what the network edge behavior and have ensured that applications cannot bypass or override that environment.

To avoid a client setting an HTTP header/cookie value to work around the impersonation check, use this configuration only when the SSO framework requires it, and when the deployed applications ensure that the client cannot manipulate the headers set into the session. HTTP headers set by the network edge take precedence.

This authentication provider does not authenticate the subject but adds the NamedCredential if the user is successfully authenticated by other authentication providers. It always returns false from the login method and should always be configured with the controlFlag set to “optional” to avoid affecting the outcome of authentication process.