Custom authentication and extending the login.jsp element.

[Paul Hethmon]

Martin,

We are seeing an attitude on your part as well. If you want commercial
level support, there are plenty of folks who would be willing to accept
your money and give that to you. As an open source project, this one gives
a hell of a lot of support, but that's not to be misconstrued with doing
it for you.

>From reading through the thread since the last time I responded, my guess
is that you have not written a login handler, you have simply replaced the
login.jsp page in some manner. So you are piggy backing on the JAAS
mechanism, which is about as bad as they come.

If you want any level of control over what happens, you MUST implement a
login handler plugin. The interfaces for that are documented well on the
wiki. Every one that Shib ships with is completely open and are great to
copy and use as a starting point.

Think of the flow in this manner:

1. User access relying party and is redirected with SAML AuthnRequest to
IdP
2. Shib, as the IdP, consumes the AuthnRequest and calls your Login Handler
3. Now your login handler can do whatever it wants. It is in control of
the HTTP session. You can ask them for credentials, show them a pretty
picture, whatever you want. What Shib wants from you is to decide whether
access is granted.
4. You finish your work and send control back to Shib.
5. If you tell Shib they were successful, then Shib creates the sAML
Response to send to the relying party.

So during step 3, you own the user experience, but only if you go the full
route and build a Login Handler.

Paul




On 8/31/12 1:25 PM, "PARDEE, MARTIN  (MARTIN)" <mlp at research.att.com>
wrote:

>Wow,  you guys really stick together.  I'm impressed.
>
>
>-----Original Message-----
>From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>On Behalf Of Chad La Joie
>Sent: Friday, August 31, 2012 1:18 PM
>To: Shib Users
>Subject: Re: Custom authentication and extending the login.jsp element.
>
>You don't have to reverse engineer anything.  The LoginHandler interface
>documents exactly what  a login handler has to do.  So, if by "reverse
>engineer" you mean "read the documentation" then yes, that's what you
>need to do.
>
>On Fri, Aug 31, 2012 at 9:57 AM, PARDEE, MARTIN  (MARTIN)
><mlp at research.att.com> wrote:
>> Scott,
>>
>> I submit the same question to you:  why not just look at the code and
>>answer my question?  Usually reverse engineering a library to figure out
>>how its'  public interfaces work is that last thing I want to do. That's
>>why I came here. I thought there would be someone who could give me some
>>help.  Guess I mis-judged that one. Is there anyone else there that I
>>can talk to?
>>
>> Martin
>>
>>
>>
>> -----Original Message-----
>> From: users-bounces at shibboleth.net
>> [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
>> Sent: Friday, August 31, 2012 12:54 PM
>> To: Shib Users
>> Subject: Re: Custom authentication and extending the login.jsp element.
>>
>> On 8/31/12 12:50 PM, "PARDEE, MARTIN  (MARTIN)" <mlp at research.att.com>
>> wrote:
>>
>>>I'm not sure you and I are on the same page yet.  Can you please tell
>>>me what happens inside shib after the Auth Handler servlet has done a
>>>re-direct to the login.jsp?
>>
>> As far as I know it submits the request back to the servlet, but why
>>not just look at the code?
>>
>> -- Scott
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
>
>--
>Chad La Joie
>www.itumi.biz
>trusted identities, delivered
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net