passive auth and login handlers

[Paul Hethmon]

On 8/11/11 3:49 PM, "Cantor, Scott E." <cantor.2 at osu.edu> wrote:

>I checked the code, it should work. You're passing back an error in the
>form of a message, but there's a separate key in the login context for
>passing back an actual exception object. Just set that to a
>PassiveAuthenticationException.


Yea, I just dug deeper in the code and found it. Testing it now. For the
record it's something like this that is needed:

        // check for an isPassive request
        if (loginContext.isPassiveAuthRequired() == true) {
           log.info("Passive authentication requested without a valid SSO
session. Returning SAML error to SP [{}]",
loginContext.getRelyingPartyId());
           PassiveAuthenticationException pae = new
PassiveAuthenticationException("Passive authentication not supported
without a previous session.");
           
httpRequest.setAttribute(LoginHandler.AUTHENTICATION_EXCEPTION_KEY, pae);
           // send them back with a SAML error, we can't support passive
without a prior session
           AuthenticationEngine.returnToAuthenticationEngine(httpRequest,
httpResponse);
           return;
        }


That goes in the login() method of the Login Handler.

Paul