I'm hoping someone here has an answer for me, I'm working on enabling the external authentication subsystem and had some questions about security.
It seems that once the system is enabled, all Alfresco needs for SSO is a header. If that Alfresco was outward facing, anyone with malicious intent, could simply insert add the Remote-User header with the value admin and have at the repository. Is there a way to ensure that the header was included from my authenticating app and not otherwise injected?
If not, would my next step be to write a custom authentication subsystem?
Thanks in advance.
