<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">You may be interested in this plugin, which does what it sounds like you are trying to achieve:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><a href="https://github.com/Unicon/shib-cas-authenticator">https://github.com/Unicon/shib-cas-authenticator</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> dev-bounces@shibboleth.net [mailto:dev-bounces@shibboleth.net]
<b>On Behalf Of </b>yanis aumont<br>
<b>Sent:</b> Wednesday, August 01, 2012 4:58 AM<br>
<b>To:</b> dev@shibboleth.net; Mehdi Hached<br>
<b>Subject:</b> SSO-CAS Login Handler<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi,<br>
<br>
I'm working at RENATER (French NREN) at developing a new login handler for the IdP and I would like to have some clues or feedbacks on what I've already done.<br>
<br>
Many French universities and higher education institutions all over the world use SSO-CAS as authentication system. Thus, as you may know, many of them who joined an academic federation run the Shibboleth IdP in conjunction with SSO-CAS (via the RemoteUser
login handler). The handler I'm developing will allow them to be compatible with one of the most common features of SAML2 originally provided by Shibboleth IdP : forced authentication. This feature is quite often asked for by administrators.<b><br>
<br>
</b>This handler is inspired from both the RemoteUser login landler and the ExternalAuthnSystem login handler. It acts as an intermediate between the Authentication Engine and the filters provided by the SSO-CAS Client. It extends AbstractLoginHandler and provides
a few methods allowing the enforcement of forced authentication through CAS. <br>
<br>
When this handler's login() is called by the Authentication Engine, these methods examine if forced authentication is required. Then they act accordingly on CAS-related attributes of the request, and build the URL of the filter to which the request is to be
forwarded. The RemoteUserAuthServlet is called after the SSO-CAS Client's filters to get the result of the authentication and return control to the Authentication Engine - just as it is done with the RemoteUser login handler.<br>
<br>
Using this handler does not imply any modification on the SSO-CAS Client or server.
<br>
<br>
Since this handler represents only a few lines of code and does not affect any other functionality of the IdP, we think that it would be valuable to implement it directly in a more generic handler. I have seen that you plan to merge the RemoteUser and the ExternalAuthnSystem
login handlers, and our code would fit well and easily in the result of the merging.<br>
<br>
Thank you for any reaction,<br>
<br>
Yanis Aumont.<o:p></o:p></p>
</div>
</div>
</body>
</html>