idp v3 authentication

[Wenlai Wang]

Hi,

We are upgrading shibboleth idp from v2 to v3. In v2, we implement custom login handler for levels of authentication: it composites a list of login handlers, and picks up the first possible handler according to the request authentication method and some custom rules, if that login handler fails, it tries the next possible login handler.  The login handler defined in handler.xml is something like:

<LoginHandler xsi:type="cust:Composite">
    <AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</AuthenticationMethod>

    <composite:LoginHandler xsi:type="cust:handler1">
      <AuthenticationMethod>level:0</AuthenticationMethod>
    </composite:LoginHandler>

    <composite:LoginHandler xsi:type="UsernamePassword" jaasConfigurationLocation="config/login.config">
      <AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthenticationMethod>
      <AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</AuthenticationMethod>
      <AuthenticationMethod>level:0</AuthenticationMethod>
    </composite:LoginHandler>

    <composite:LoginHandler xsi:type="cust:handler2" jaasConfigurationLocation="config/login.config">
      <AuthenticationMethod>classes:Token</AuthenticationMethod>
      <AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthenticationMethod>
      <AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</AuthenticationMethod>
      <AuthenticationMethod>level:0</AuthenticationMethod>
    </composite:LoginHandler>
  </LoginHandler>

In idp v3, it has feature to compose/combine login flows, not sure if it can fit our requirement. Another solution can be external authentication. Can someone give us suggestion which is the better way for our use case, external authentication or login flows?  Are there any documentations/examples for implementing external authentication or login flows?

In idp v2, it has a helper class HttpServletHelpe which provides access to internal state from servlets. Is there a compatible class in v3?

Thanks,
Wenlai
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160309/b370efd7/attachment-0001.html>