PHP Warning: Undefined array key REMOTE_USER in ShibbolethAuthenticationService::init()

[magicsunday]

Description

When a request reaches the TYPO3 backend without a Shibboleth session (e.g. direct backend login, CLI, or any non-Shibboleth request), ShibbolethAuthenticationService::init() triggers a PHP warning:

PHP Warning: Undefined array key "REMOTE_USER" in
Classes/Typo3/Service/ShibbolethAuthenticationService.php line 53

Root Cause

In init() at line 53, $_SERVER[$this->extensionConfiguration['remoteUser']] is accessed without checking if the key exists:

$this->remoteUser = $_SERVER[$this->extensionConfiguration['remoteUser']];

When there is no Shibboleth session active, $_SERVER['REMOTE_USER'] is not set, causing the warning.

Expected Behavior

No PHP warning should be emitted. The $remoteUser property should gracefully default to null when REMOTE_USER is not present in $_SERVER.

Proposed Fix

Use the null coalescing operator:

$this->remoteUser = $_SERVER[$this->extensionConfiguration['remoteUser']] ?? null;

This is safe because the property is already typed as ?string and all usages of $this->remoteUser handle null/empty correctly via empty() checks.

Environment

• TYPO3 v13.4
• PHP 8.4
• shibboleth_auth: dev-main