QA

In order to test you have to have some facility to ensure that EVERY REQUEST includes a header value pair of something like:

REMOTE_USER:admin

(it doesn't have to be admin, it has to be any user in the system). So for local testing, the simplest way to test is to try to go to application URLs like - http://localhost:8080/dashboard/metadata/manager/resolvers 

Without the header, you shouldn't be able to get to any of the urls.

With the header, you should be able to do whatever your user is allowed to do (ie for admin, you can do anything).

To include the header in every request, you can try using a browser plugin - ModHeader for Chrome is stupidly easy (though I think you have to open your new tab AFTER you set the header in the extension). At any rate, ModHeader and other similar type plugins should grab every request and stuff whatever you want into every request.

The application.yml file's top lines should be like:

shibui:

  pac4j-enabled: true

  pac4j:

    type-of-auth: HEADER

    authentication-header: USERNAME

ALTERNATELY - talk to JJ about the reverse proxy setup which would be what a system user would really have (but realistically should be more or less the same).