Description
By default the remote user is obtained by using the HttpServletRequest#getRemoteUser() method which return the authenticated user from the container.
By setting the xwiki.authentication.ldap.httpHeader variable, the remote user will be take from an HTTP header.
The server administrator is responsible to ensure that this http header could not be forged, and this parameter is xwiki.cfg only to prevent malicious usage.