Custom Remote User Handler

[Christopher Bongaarts]

On 3/6/2012 10:54 AM, Christopher Bland wrote:
> Christopher Bongaarts,
>
> What I am trying to do is going to require jumping through many hoops
> but it is built on a single (what I hope is simple) principle. Based on
> my reading and understanding I should be able to specify
> https://idp.fdu.edu/idp/Authn/GoogleApps as my " *Sign-in page URL"*.

Not quite: what Google needs is your SSO protocol endpoint URL 
(/idp/profile/SAML2/Redirect/SSO), not your RemoteUser handler URL.

The IdP SSO protocol handler will receive the SAML request from Google 
Apps, then consult your configuration to see which login handler it 
should invoke.  If you configure it to use RemoteUser, it will redirect 
the user to your RemoteUser handler URL (/idp/Authn/RemoteUser or 
/idp/Authn/whatever if you change it, but there's rarely a good reason 
to do so).

> This of course a IDP REMOTE_USER handler, which means I can have an
> Apache based authentication in place to validate users and my IDP will
> communicate back to Google allowing users to access their files and email.

Yes, that's what the RemoteUser login handler does, and any Apache 
authentication that sets REMOTE_USER should work.

But there's not really any good reason to change the RemoteUser handler 
URL in this case.
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%