SSO-CAS Login Handler

[yanis aumont]

Hi,

I'm working at RENATER (French NREN) at developing a new login handler 
for the IdP and I would like to have some clues or feedbacks on what 
I've already done.

Many French universities and higher education institutions all over the 
world use SSO-CAS as authentication system. Thus, as you may know, many 
of them who joined an academic federation run the Shibboleth IdP in 
conjunction with SSO-CAS (via the RemoteUser login handler). The handler 
I'm developing will allow them to be compatible with one of the most 
common features of SAML2 originally provided by Shibboleth IdP : forced 
authentication. This feature is quite often asked for by administrators.*

*This handler is inspired from both the RemoteUser login landler and the 
ExternalAuthnSystem login handler. It acts as an intermediate between 
the Authentication Engine and the filters provided by the SSO-CAS 
Client. It extends AbstractLoginHandler and provides a few methods 
allowing the enforcement of forced authentication through CAS.

When this handler's login() is called by the Authentication Engine, 
these methods examine if forced authentication is required. Then they 
act accordingly on CAS-related attributes of the request, and build the 
URL of the filter to which the request is to be forwarded. The 
RemoteUserAuthServlet is called after the SSO-CAS Client's filters to 
get the result of the authentication and return control to the 
Authentication Engine - just as it is done with the RemoteUser login 
handler.

Using this handler does not imply any modification on the SSO-CAS Client 
or server.

Since this handler represents only a few lines of code and does not 
affect any other functionality of the IdP, we think that it would be 
valuable to implement it directly in a more generic handler. I have seen 
that you plan to merge the RemoteUser and the ExternalAuthnSystem login 
handlers, and our code would fit well and easily in the result of the 
merging.

Thank you for any reaction,

Yanis Aumont.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120801/df7342dd/attachment.html