<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix"><br>
<br>
Le 01/08/2012 13:56, Caskey, Paul a écrit :<br>
</div>
<blockquote
cite="mid:788B43FEFE8CD84A8BCCD3B5A3336EAF06E198C9@EX10b.utsystem.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">You
may be interested in this plugin, which does what it sounds
like you are trying to achieve:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><a moz-do-not-send="true"
href="https://github.com/Unicon/shib-cas-authenticator">https://github.com/Unicon/shib-cas-authenticator</a></span></p>
</div>
</blockquote>
Thanks for the answer, but I already had a look at this plugin and
studied it.
<br>
It did help me, but my goal was a bit different : I wanted to
develop a new login handler, thus avoiding the need to establish an
intermediate CAS-protected resource, as it is done with this
shib-cas-authenticator plugin. <br>
<br>
<blockquote
cite="mid:788B43FEFE8CD84A8BCCD3B5A3336EAF06E198C9@EX10b.utsystem.local"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family:
"Calibri","sans-serif"; color: rgb(31,
73, 125);"><o:p> </o:p></span><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">you
are trying to achieve</span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
</div>
</blockquote>
The login handler I have developed does work.<br>
I actually have contacted Shibboleth development team to get their
opinion on the possibility to integrate this handler to the default
IdP (which would obviously not be possible with the
shib-cas-authenticator).<br>
<br>
<blockquote
cite="mid:788B43FEFE8CD84A8BCCD3B5A3336EAF06E198C9@EX10b.utsystem.local"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in
0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">
<a class="moz-txt-link-abbreviated" href="mailto:dev-bounces@shibboleth.net">dev-bounces@shibboleth.net</a>
[<a class="moz-txt-link-freetext" href="mailto:dev-bounces@shibboleth.net">mailto:dev-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>yanis aumont<br>
<b>Sent:</b> Wednesday, August 01, 2012 4:58 AM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:dev@shibboleth.net">dev@shibboleth.net</a>; Mehdi Hached<br>
<b>Subject:</b> SSO-CAS Login Handler<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">Hi,<br>
<br>
I'm working at RENATER (French NREN) at developing a new
login handler for the IdP and I would like to have some
clues or feedbacks on what I've already done.<br>
<br>
Many French universities and higher education institutions
all over the world use SSO-CAS as authentication system.
Thus, as you may know, many of them who joined an academic
federation run the Shibboleth IdP in conjunction with
SSO-CAS (via the RemoteUser login handler). The handler I'm
developing will allow them to be compatible with one of the
most common features of SAML2 originally provided by
Shibboleth IdP : forced authentication. This feature is
quite often asked for by administrators.<b><br>
<br>
</b>This handler is inspired from both the RemoteUser login
landler and the ExternalAuthnSystem login handler. It acts
as an intermediate between the Authentication Engine and the
filters provided by the SSO-CAS Client. It extends
AbstractLoginHandler and provides a few methods allowing the
enforcement of forced authentication through CAS. <br>
<br>
When this handler's login() is called by the Authentication
Engine, these methods examine if forced authentication is
required. Then they act accordingly on CAS-related
attributes of the request, and build the URL of the filter
to which the request is to be forwarded. The
RemoteUserAuthServlet is called after the SSO-CAS Client's
filters to get the result of the authentication and return
control to the Authentication Engine - just as it is done
with the RemoteUser login handler.<br>
<br>
Using this handler does not imply any modification on the
SSO-CAS Client or server.
<br>
<br>
Since this handler represents only a few lines of code and
does not affect any other functionality of the IdP, we think
that it would be valuable to implement it directly in a more
generic handler. I have seen that you plan to merge the
RemoteUser and the ExternalAuthnSystem login handlers, and
our code would fit well and easily in the result of the
merging.<br>
<br>
Thank you for any reaction,<br>
<br>
Yanis Aumont.<o:p></o:p></p>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<br>
</body>
</html>