Is it possible to hit the IdP login form directly from a browser?

[Nate Klingenstein]

Yaowen,

> Based on my experience with SAML( very limited ), I think it make  
> sense that user login to IdP first to establish a valid session,  
> then later on he can access some SP protected resources without  
> entering the password. There should be some reason that I missed to  
> explain the potential problem for this approach.

There is no real problem with it.  The Shibboleth IdP just doesn't  
directly address this use case; SSO sessions are always established in  
the context of authenticating to something other than the IdP.  You  
could do this implementation if you wanted to.

I'd suggest doing it through a dedicated handler rather than making  
the authentication handler "just assume" the user wanted to  
authenticate and go nowhere.  You'll also probably want some  
meaningful workflows on the page that results from a successful  
authentication.

I would probably just implement this as authentication to a portal,  
though.  Because you want meaningful workflows at the end, why not  
just achieve SSO that way?

>
> Another related question is, I know there is something called "IdP- 
> initiated" SSO, which is user hit /idp/profile/SAML2/Unsolicited/SSO  
> directly, then IdP redirect to a login page. Do we support something  
> like this to automatically get the user name and password?
>                  /idp/profile/SAML2/Unsolicited/SSO? 
> username=user1&password=password1
>
> I have been thinking about the reason of it. Is it because that SAML  
> doesn't actually define how IdP authenticate a user? So it is every  
> IdP's responsibility and interoperability is an issue? What else?

No, the IdP doesn't support this, and putting sensitive data in a GET  
request is not really a best practice.

Take care,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120901/ed2ebb73/attachment-0001.html