User's context
Marco Zanini
marco.zanini at lero.ie
Wed Mar 7 10:47:43 GMT 2012
Thank you for the answer, and after authentication? Is there a way to get
some more information about user's context? Maybe after login?
What do you think is the best way to modify shibboleth's behaviour based on
user's context? Should I edit xml files or is there a way to call some kind
of shibboleth's API?
Many thanks,
Marco
On 7 March 2012 10:39, <users-request at shibboleth.net> wrote:
> Send users mailing list submissions to
> users at shibboleth.net
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://shibboleth.net/mailman/listinfo/users
> or, via email, send a message with subject or body 'help' to
> users-request at shibboleth.net
>
> You can reach the person managing the list at
> users-owner at shibboleth.net
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of users digest..."
>
>
> Today's Topics:
>
> 1. Re: Custom Remote User Handler (Chad La Joie)
> 2. Re: Custom Remote User Handler (Christopher Bland)
> 3. Re: Custom Remote User Handler (Chad La Joie)
> 4. Re: WAYF no longer linking correctly (Tom Scavo)
> 5. User's context (Marco Zanini)
> 6. Re: User's context (Chad La Joie)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 6 Mar 2012 12:18:53 -0500
> From: Chad La Joie <lajoie at itumi.biz>
> Subject: Re: Custom Remote User Handler
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> <CACTY7uCEeZ2dU=tEx7aM3M4Kd2Q1Z-ODjSebM4U-S6Dv9d23OQ at mail.gmail.com
> >
> Content-Type: text/plain; charset=ISO-8859-1
>
> Well, I think you're just confused about SAML in general. The public
> interface to the IdP are the SAML endpoints that it exposes. When the
> request that comes in is an authentication request then the IdP will
> try to authenticate a user via one of its configured authentication
> mechanisms. This document talks about how the authentication
> mechanism is selected:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn
>
> Why don't you start from the beginning and tell us what you're trying
> to accomplish instead of starting with question about specific
> configuration changes. The answer may be "you don't need to do
> anything special".
>
>
> On Tue, Mar 6, 2012 at 12:10, Christopher Bland <chris at fdu.edu> wrote:
> >
> > Chad,
> >
> > Now I'm confused.? In our current implementation we are using a SAML
> > profile (https://idp.fdu.edu/idp/profile/SAML2/Redirect/SSO) but I do
> not
> > believe there is a remote user profile or at least I didn't get that
> from my
> > reading on setting remote user up.? Clearly I need to expand my
> > understanding of this.? I think I am missing the link between login
> handlers
> > and profiles.
> >
> > Any suggested docs?
> >
> > -Chris
> >
> >
> > On 3/6/12 11:57 AM, Chad La Joie wrote:
> >
> > No, you can not directly target URLs used by the authentication engine.
> >
> > On Tue, Mar 6, 2012 at 11:54, Christopher Bland <chris at fdu.edu> wrote:
> >
> > Based on my reading and understanding I should be able to specify
> > https://idp.fdu.edu/idp/Authn/GoogleApps as my " Sign-in page URL".
> >
> >
> > --
> > Chad La Joie
> > www.itumi.biz
> > trusted identities, delivered
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> >
> >
> >
> > --
> > Christopher Bland
> > Systems Manager
> > Information Systems and Technology
> > 1000 River Road, Teaneck NJ 07666
> > Mail Stop: T-BH1-01
> > : 201-692-2414 | : 201-692-2494 | : chris at fdu.edu
> > "Fairleigh Dickinson University will never
> > ?????????????????????????????????ask for your password. Please do not
> > share it with others!"
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
>
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
>
>
> ------------------------------
>
> Message: 2
> Date: Tue, 06 Mar 2012 13:24:18 -0500
> From: Christopher Bland <chris at fdu.edu>
> Subject: Re: Custom Remote User Handler
> To: users at shibboleth.net
> Message-ID: <4F565652.6050902 at fdu.edu>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Chad,
>
> Thanks for the link to IdpUserAuthn doc. I had read it before dealing
> with another issue but totally missed my current need to specify the
> authentication method in Google's custom relying party tag. Do you think
> that the following changes will work:
>
> relying-party.xml
> <RelyingParty id="google.com"
> provider="https://idp.fdu.edu/idp/shibboleth"
> defaultAuthenticationMethod="??????? not sure of appropriate class for
> remote user ???????"
> defaultSigningCredentialRef="IdPCredential">
> <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
> encryptAssertions="never" encryptNameIds="never" />
> </RelyingParty>
>
> handler.xml
> <ph:LoginHandler xsi:type="ph:RemoteUser">
> <ph:protectedServletPath="/idp/Authn/GoogleApps">
>
> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:?????????</ph:AuthenticationMethod>
> (don't want to use unspecified because then it becomes default)
> </ph:LoginHandler>
>
> web.xml
> <servlet>
> <servlet-name>GoogleAppsAuthHandler</servlet-name>
>
> <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet</servlet-class>
> <load-on-startup>5</load-on-startup>
> </servlet>
>
> <servlet-mapping>
> <servlet-name>GoogleAppsAuthHandler</servlet-name>
> <url-pattern>/Authn/GoogleApps</url-pattern>
> </servlet-mapping>
>
> http.conf
> <Location /idp/Authn/GoogleApps>
> AuthType Basic AuthName "Identity Provider Authentication"
> AuthUserFile /PATH/TO/USER/FILE
> require valid-user
> </Location>
>
>
> -Chris
>
> On 3/6/12 12:18 PM, Chad La Joie wrote:
> > Well, I think you're just confused about SAML in general. The public
> > interface to the IdP are the SAML endpoints that it exposes. When the
> > request that comes in is an authentication request then the IdP will
> > try to authenticate a user via one of its configured authentication
> > mechanisms. This document talks about how the authentication
> > mechanism is selected:
> > https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://shibboleth.net/pipermail/users/attachments/20120306/c829c6e8/attachment-0001.html
>
> ------------------------------
>
> Message: 3
> Date: Tue, 6 Mar 2012 13:31:37 -0500
> From: Chad La Joie <lajoie at itumi.biz>
> Subject: Re: Custom Remote User Handler
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> <CACTY7uAGqzWcgW+8EcOmMK0GtbNjUQ0AN901gbKdwZtAKFyuwQ at mail.gmail.com
> >
> Content-Type: text/plain; charset=ISO-8859-1
>
> You will need to pick a URI for your custom method. You can *not* use
> the urn:oasis:names:tc:SAML namespace as that's controlled by the SAML
> committee. But it's just a URI so pick a URL you control.
>
> On Tue, Mar 6, 2012 at 13:24, Christopher Bland <chris at fdu.edu> wrote:
> > Chad,
> >
> > Thanks for the link to IdpUserAuthn doc.? I had read it before dealing
> with
> > another issue but totally missed my current need to specify the
> > authentication method in Google's custom relying party tag. Do you think
> > that the following changes will work:
> >
> > relying-party.xml
> > ??? <RelyingParty id="google.com"
> > ??????????? provider="https://idp.fdu.edu/idp/shibboleth"
> > ??????????? defaultAuthenticationMethod="??????? not sure of appropriate
> > class for remote user ???????"
> > ??????????? defaultSigningCredentialRef="IdPCredential">
> > ??????? <ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
> > encryptAssertions="never" encryptNameIds="never" />
> > ??? </RelyingParty>
> >
> > handler.xml
> > ??? <ph:LoginHandler xsi:type="ph:RemoteUser">
> > ??????? <ph:protectedServletPath="/idp/Authn/GoogleApps">
> >
> >
> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:?????????</ph:AuthenticationMethod>
> > (don't want to use unspecified because then it becomes default)
> > ??? </ph:LoginHandler>
> >
> > web.xml
> > ??? <servlet>
> > ??????? <servlet-name>GoogleAppsAuthHandler</servlet-name>
> >
> >
> <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.RemoteUserAuthServlet</servlet-class>
> > ??????? <load-on-startup>5</load-on-startup>
> > ??? </servlet>
> >
> > ??? <servlet-mapping>
> > ??????? <servlet-name>GoogleAppsAuthHandler</servlet-name>
> > ??????? <url-pattern>/Authn/GoogleApps</url-pattern>
> > ??? </servlet-mapping>
> >
> > http.conf
> > ??? <Location /idp/Authn/GoogleApps>
> > ????????? AuthType Basic AuthName "Identity Provider Authentication"
> > ????????? AuthUserFile /PATH/TO/USER/FILE
> > ????????? require valid-user
> > ??? </Location>
> >
> >
> > -Chris
> >
> >
> > On 3/6/12 12:18 PM, Chad La Joie wrote:
> >
> > Well, I think you're just confused about SAML in general. The public
> > interface to the IdP are the SAML endpoints that it exposes. When the
> > request that comes in is an authentication request then the IdP will
> > try to authenticate a user via one of its configured authentication
> > mechanisms. This document talks about how the authentication
> > mechanism is selected:
> > https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn
> >
> >
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
>
>
> ------------------------------
>
> Message: 4
> Date: Tue, 6 Mar 2012 19:14:45 -0500
> From: Tom Scavo <trscavo at gmail.com>
> Subject: Re: WAYF no longer linking correctly
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> <CAEtu=dNP-oebbRYF5MtGSAcT=JL59U1u1KYeW10uBQpVJP4aCg at mail.gmail.com
> >
> Content-Type: text/plain; charset=ISO-8859-1
>
> On Tue, Mar 6, 2012 at 10:41 AM, Chad La Joie <lajoie at itumi.biz> wrote:
> > And does that error occur if you run a recent version of the DS?
> > 1.1.3 is the latest.
>
> Rod should be able to answer that question immediately. In any case,
> InCommon has received multiple such reports of errors, so we will
> remove the embedded double quotes from InCommon metadata ASAP. That
> means tomorrow's signed metadata aggregate will not contain embedded
> double quotes.
>
> Tom Scavo
> Operations Manager
> InCommon.org
>
> > On Tue, Mar 6, 2012 at 10:19, Tom Scavo <trscavo at gmail.com> wrote:
> >> On Tue, Mar 6, 2012 at 10:05 AM, Gabriel Jimenez <Gabe.Jimenez at nau.edu>
> wrote:
> >>>
> >>> We are using shibboleth-discovery-service-1.1.0.
> >>
> >> Then I believe this is a bug and you should file an issue in Shibboleth
> jira.
> >>
> >> Tom
> >> --
> >> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> >
> >
> >
> > --
> > Chad La Joie
> > www.itumi.biz
> > trusted identities, delivered
> > --
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> ------------------------------
>
> Message: 5
> Date: Wed, 7 Mar 2012 10:06:53 +0000
> From: Marco Zanini <marco.zanini at lero.ie>
> Subject: User's context
> To: users at shibboleth.net
> Message-ID:
> <CAG1Po3t9SAOZGBCWJNgs7STRd9RQ644c=bOqn65LAoTX4oE9Cg at mail.gmail.com
> >
> Content-Type: text/plain; charset="iso-8859-1"
>
> Hi to all,
> I am about to develop an application to apply different countermeasures
> depending on the user's context. I would like for example the user to use
> different types of login (username/password, two-step authentication) based
> on the context. I was thinking of developing an external authentication
> component for shibboleth.
> *What are the information about user's context that I can get from
> shibboleth when it calls my login handler?*
> I am using Google Apps as my service provider.
>
> Thank you,
> Marco
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://shibboleth.net/pipermail/users/attachments/20120307/e7ab50ca/attachment-0001.html
>
> ------------------------------
>
> Message: 6
> Date: Wed, 7 Mar 2012 05:39:21 -0500
> From: Chad La Joie <lajoie at itumi.biz>
> Subject: Re: User's context
> To: Shib Users <users at shibboleth.net>
> Message-ID:
> <CACTY7uBeDCTOfddsrZJv_pgdxW_M6P-5ZhT66Xs4UZib-sui8Q at mail.gmail.com
> >
> Content-Type: text/plain; charset=ISO-8859-1
>
> Well, prior to authentication the only thing you know is the protocol
> in use (SAML 1 or 2), the SP requesting the authentication, and if it
> requested a specific method. All of that is available in the
> LoginContext object available to the login handler.
>
> On Wed, Mar 7, 2012 at 05:06, Marco Zanini <marco.zanini at lero.ie> wrote:
> > Hi to all,
> > I am about to develop an application to apply different countermeasures
> > depending on the user's context. I would like for example the user to use
> > different types of login (username/password, two-step authentication)
> based
> > on the context. I was thinking of developing an external authentication
> > component for shibboleth.
> > What are the information about user's context that I can get from
> shibboleth
> > when it calls my login handler?
> > I am using Google Apps as my service provider.
> >
> > Thank you,
> > Marco
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
>
>
> ------------------------------
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> End of users Digest, Vol 9, Issue 19
> ************************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120307/a6b7673c/attachment-0001.html
More information about the users
mailing list