Custom Remote User Handler

[Chad La Joie]

You will need to pick a URI for your custom method.  You can *not* use
the urn:oasis:names:tc:SAML namespace as that's controlled by the SAML
committee.  But it's just a URI so pick a URL you control.

On Tue, Mar 6, 2012 at 13:24, Christopher Bland <chris at fdu.edu> wrote:
> Chad,
>
> Thanks for the link to IdpUserAuthn doc.  I had read it before dealing with
> another issue but totally missed my current need to specify the
> authentication method in Google's custom relying party tag. Do you think
> that the following changes will work:
>
> relying-party.xml
>     <RelyingParty id="google.com"
>             provider="https://idp.fdu.edu/idp/shibboleth"
>             defaultAuthenticationMethod="??????? not sure of appropriate
> class for remote user ???????"
>             defaultSigningCredentialRef="IdPCredential">
>         <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
> encryptAssertions="never" encryptNameIds="never" />
>     </RelyingParty>
>
> handler.xml
>     <ph:LoginHandler xsi:type="ph:RemoteUser">
>         <ph:protectedServletPath="/idp/Authn/GoogleApps">
>
> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:?????????</ph:AuthenticationMethod>
> (don't want to use unspecified because then it becomes default)
>     </ph:LoginHandler>
>
> web.xml
>     <servlet>
>         <servlet-name>GoogleAppsAuthHandler</servlet-name>
>
> <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet</servlet-class>
>         <load-on-startup>5</load-on-startup>
>     </servlet>
>
>     <servlet-mapping>
>         <servlet-name>GoogleAppsAuthHandler</servlet-name>
>         <url-pattern>/Authn/GoogleApps</url-pattern>
>     </servlet-mapping>
>
> http.conf
>     <Location /idp/Authn/GoogleApps>
>           AuthType Basic AuthName "Identity Provider Authentication"
>           AuthUserFile /PATH/TO/USER/FILE
>           require valid-user
>     </Location>
>
>
> -Chris
>
>
> On 3/6/12 12:18 PM, Chad La Joie wrote:
>
> Well, I think you're just confused about SAML in general.  The public
> interface to the IdP are the SAML endpoints that it exposes.  When the
> request that comes in is an authentication request then the IdP will
> try to authenticate a user via one of its configured authentication
> mechanisms.  This document talks about how the authentication
> mechanism is selected:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered