Quoting the original source (https://github.com/theforeman/foreman/pull/10260#discussion_r1734924041):

"Using request.env made sense back when we used Passenger, because it could send some things directly to request.env meaning users couldn't override them via headers at all. These days we only support Puma behind a reverse proxy and we configure Apache to filter the headers. CAS_USERNAME is also hardcoded so it doesn't support using non-headers at all now.

That said, the source code there does have special handling for some headers which includes Remote-User. That is good to verify."