diff --git a/config/alfresco/subsystems/Authentication/external/external-filter-context.xml b/config/alfresco/subsystems/Authentication/external/external-filter-context.xml
new file mode 100644
index 0000000000..2a89b9e61a
--- /dev/null
+++ b/config/alfresco/subsystems/Authentication/external/external-filter-context.xml
@@ -0,0 +1,21 @@
+
+
+
+
+
+
+
+ ${external.authentication.proxyUserName}
+
+
+ ${external.authentication.proxyHeader}
+
+
+ ${external.authentication.enabled}
+
+
+ ${external.authentication.userIdPattern}
+
+
+
+
\ No newline at end of file
diff --git a/config/alfresco/subsystems/Authentication/external/external-filter.properties b/config/alfresco/subsystems/Authentication/external/external-filter.properties
new file mode 100644
index 0000000000..476a605f81
--- /dev/null
+++ b/config/alfresco/subsystems/Authentication/external/external-filter.properties
@@ -0,0 +1,4 @@
+external.authentication.proxyUserName=alfresco-system
+external.authentication.proxyHeader=X-Alfresco-Remote-User
+external.authentication.enabled=true
+external.authentication.userIdPattern=
diff --git a/config/alfresco/web-client-application-context.xml b/config/alfresco/web-client-application-context.xml
index e66fbcb8b2..0bea82dff8 100644
--- a/config/alfresco/web-client-application-context.xml
+++ b/config/alfresco/web-client-application-context.xml
@@ -170,6 +170,21 @@
+
+
+
+ org.alfresco.web.app.servlet.RemoteUserMapper
+ org.alfresco.repo.management.subsystems.ActivateableBean
+
+
+
+ remoteUserMapper
+
+
+
null or empty, then the header will be checked regardless of
+ * remote user identity.
+ */
+ public void setProxyUserName(String proxyUserName)
+ {
+ this.proxyUserName = proxyUserName == null || proxyUserName.length() == 0 ? null : proxyUserName;
+ }
+
+ /**
+ * Sets the name of the header containing the ID of a proxied user.
+ *
+ * @param proxyHeader
+ * the proxy header name
+ */
+ public void setProxyHeader(String proxyHeader)
+ {
+ this.proxyHeader = proxyHeader;
+ }
+
+ /**
+ * Controls whether the mapper is enabled. When disabled {@link #getRemoteUser(HttpServletRequest)} will always
+ * return null
+ *
+ * @param isEnabled
+ * Is this mapper enabled?
+ */
+ public void setActive(boolean isEnabled)
+ {
+ this.isEnabled = isEnabled;
+ }
+
+ /**
+ * Sets a regular expression for extracting a user ID from the header. If this is not set, then the entire contents
+ * of the header will be used as the user ID.
+ *
+ * @param userIdPattern
+ * the regular expression
+ */
+ public void setUserIdPattern(String userIdPattern)
+ {
+ this.userIdPattern = userIdPattern == null || userIdPattern.length() == 0 ? null : Pattern
+ .compile(userIdPattern);
+ }
+
+ /*
+ * (non-Javadoc)
+ * @see org.alfresco.web.app.servlet.RemoteUserMapper#getRemoteUser(javax.servlet.http.HttpServletRequest)
+ */
+ public String getRemoteUser(HttpServletRequest request)
+ {
+ if (!this.isEnabled)
+ {
+ return null;
+ }
+ if (this.proxyUserName == null)
+ {
+ return extractUserFromProxyHeader(request);
+ }
+ else
+ {
+ String userId = request.getRemoteUser();
+ if (userId == null)
+ {
+ return null;
+ }
+ if (userId.equals(this.proxyUserName))
+ {
+ userId = extractUserFromProxyHeader(request);
+ }
+ return userId;
+ }
+ }
+
+ /* (non-Javadoc)
+ * @see org.alfresco.repo.management.subsystems.ActivateableBean#isActive()
+ */
+ public boolean isActive()
+ {
+ return this.isEnabled;
+ }
+
+ /**
+ * Extracts a user ID from the proxy header. If a user ID pattern has been configured returns the contents of the
+ * first matching regular expression group or null. Otherwise returns the trimmed header contents or
+ * null.
+ *
+ * @param request
+ * the request
+ * @return the user ID
+ */
+ private String extractUserFromProxyHeader(HttpServletRequest request)
+ {
+ String userId = request.getHeader(this.proxyHeader);
+ if (userId == null)
+ {
+ return null;
+ }
+ if (this.userIdPattern == null)
+ {
+ userId = userId.trim();
+ }
+ else
+ {
+ Matcher matcher = this.userIdPattern.matcher(userId);
+ if (matcher.matches())
+ {
+ userId = matcher.group().trim();
+ }
+ }
+ return userId.length() == 0 ? null : userId;
+ }
+
+}
diff --git a/source/java/org/alfresco/web/app/servlet/RemoteUserMapper.java b/source/java/org/alfresco/web/app/servlet/RemoteUserMapper.java
new file mode 100644
index 0000000000..1c20ed5294
--- /dev/null
+++ b/source/java/org/alfresco/web/app/servlet/RemoteUserMapper.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2005-2009 Alfresco Software Limited.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+ * As a special exception to the terms and conditions of version 2.0 of
+ * the GPL, you may redistribute this Program in connection with Free/Libre
+ * and Open Source Software ("FLOSS") applications as described in Alfresco's
+ * FLOSS exception. You should have received a copy of the text describing
+ * the FLOSS exception, and it is also available here:
+ * http://www.alfresco.com/legal/licensing"
+ */
+package org.alfresco.web.app.servlet;
+
+import javax.servlet.http.HttpServletRequest;
+
+/**
+ * An interface for objects capable of extracting an externally authenticated user ID from an HTTP request.
+ *
+ * @author dward
+ */
+public interface RemoteUserMapper
+{
+ /**
+ * Gets an externally authenticated user ID from an HTTP request.
+ *
+ * @param request
+ * the request
+ * @return the user ID or null if the user is unauthenticated
+ */
+ public String getRemoteUser(HttpServletRequest request);
+}