SSO-CAS Login Handler

[yanis aumont]

Le 01/08/2012 13:56, Caskey, Paul a écrit :
>
> You may be interested in this plugin, which does what it sounds like 
> you are trying to achieve:
>
> https://github.com/Unicon/shib-cas-authenticator
>
Thanks for the answer, but I already had a look at this plugin and 
studied it.
It did help me, but my goal was a bit different : I wanted to develop a 
new login handler, thus avoiding the need to establish an intermediate 
CAS-protected resource, as it is done with this shib-cas-authenticator 
plugin.

> you are trying to achieve
>
The login handler I have developed does work.
I actually have contacted Shibboleth development team to get their 
opinion on the possibility to integrate this handler to the default IdP 
(which would obviously not be possible with the shib-cas-authenticator).

> *From:*dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] 
> *On Behalf Of *yanis aumont
> *Sent:* Wednesday, August 01, 2012 4:58 AM
> *To:* dev at shibboleth.net; Mehdi Hached
> *Subject:* SSO-CAS Login Handler
>
> Hi,
>
> I'm working at RENATER (French NREN) at developing a new login handler 
> for the IdP and I would like to have some clues or feedbacks on what 
> I've already done.
>
> Many French universities and higher education institutions all over 
> the world use SSO-CAS as authentication system. Thus, as you may know, 
> many of them who joined an academic federation run the Shibboleth IdP 
> in conjunction with SSO-CAS (via the RemoteUser login handler). The 
> handler I'm developing will allow them to be compatible with one of 
> the most common features of SAML2 originally provided by Shibboleth 
> IdP : forced authentication. This feature is quite often asked for by 
> administrators.*
>
> *This handler is inspired from both the RemoteUser login landler and 
> the ExternalAuthnSystem login handler. It acts as an intermediate 
> between the Authentication Engine and the filters provided by the 
> SSO-CAS Client. It extends AbstractLoginHandler and provides a few 
> methods allowing the enforcement of forced authentication through CAS.
>
> When this handler's login() is called by the Authentication Engine, 
> these methods examine if forced authentication is required. Then they 
> act accordingly on CAS-related attributes of the request, and build 
> the URL of the filter to which the request is to be forwarded. The 
> RemoteUserAuthServlet is called after the SSO-CAS Client's filters to 
> get the result of the authentication and return control to the 
> Authentication Engine - just as it is done with the RemoteUser login 
> handler.
>
> Using this handler does not imply any modification on the SSO-CAS 
> Client or server.
>
> Since this handler represents only a few lines of code and does not 
> affect any other functionality of the IdP, we think that it would be 
> valuable to implement it directly in a more generic handler. I have 
> seen that you plan to merge the RemoteUser and the ExternalAuthnSystem 
> login handlers, and our code would fit well and easily in the result 
> of the merging.
>
> Thank you for any reaction,
>
> Yanis Aumont.
>
>
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120801/e2071cc2/attachment-0001.html