passive auth and login handlers

[Paul Hethmon]

One more follow up. This gets the SAML Response correct, however, Shib
still logs an ERROR from AuthenticationEngine. Doesn't seem like it should.

Paul


On 8/11/11 3:54 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:

>On 8/11/11 3:49 PM, "Cantor, Scott E." <cantor.2 at osu.edu> wrote:
>
>>I checked the code, it should work. You're passing back an error in the
>>form of a message, but there's a separate key in the login context for
>>passing back an actual exception object. Just set that to a
>>PassiveAuthenticationException.
>
>
>Yea, I just dug deeper in the code and found it. Testing it now. For the
>record it's something like this that is needed:
>
>        // check for an isPassive request
>        if (loginContext.isPassiveAuthRequired() == true) {
>           log.info("Passive authentication requested without a valid SSO
>session. Returning SAML error to SP [{}]",
>loginContext.getRelyingPartyId());
>           PassiveAuthenticationException pae = new
>PassiveAuthenticationException("Passive authentication not supported
>without a previous session.");
>           
>httpRequest.setAttribute(LoginHandler.AUTHENTICATION_EXCEPTION_KEY, pae);
>           // send them back with a SAML error, we can't support passive
>without a prior session
>           AuthenticationEngine.returnToAuthenticationEngine(httpRequest,
>httpResponse);
>           return;
>        }
>
>
>That goes in the login() method of the Login Handler.
>
>Paul
>
>
>--
>To unsubscribe from this list send an email to
>dev-unsubscribe at shibboleth.net