newbie question.

[PARDEE, MARTIN (MARTIN)]

Peter,  

Ok, fair enough. Here's where I get confused:

In using the LDAP authentication mechanism I modified the login.config file to point to my local LDAP server
Using a my URL and baseDn. The user filter was specified as "uid={0}", which, without any further info I
Assume to mean will get a user ID from an incoming SAML request somehow.

I created a DataConnector in attribute-resolver.xml to access this ldap server, using my credentials as the "principal" . 

I then created an attribute definition in attribute-resolver.xml to pull in the ldap person attributes that I cared about.

The fact that this work is great. But it took me a while,  the specifics of what needed to go into the "principal" field were unclear at first.  I needed to use Wireshark to see the ldap traffic before I could figure it out. 

So even though I can make the ldap connection work, it doesn't help me understand what I'm doing.  For instance:

1) how does ldap tell the IdP if a login attempt fails? I don't see the details of the conversation between the external authenticator and shibboleth in any of the documentation pages I've read. The details of the exchange appear to be hidden from me (this is a good news/bad news proposition).

2) even though I've managed to make the SP "protect" a resource on my IIS7 server, the documentation tells me that the entityID I enter in the shibboleth2.xml file is just an identifier,  not a real URL.  So I don't fully understand how to tell the SP that I want "this particular jsp" or "all of the jsp's in this folder" to be protected by my authenticator.

3) by extension: in trying to understand how to use the handler.xml file to use an external authentication mechanism via the LoginHandler element,
It is not clear how to accomplish several things.  Firstly:  How does a person identify the required custom JSP to the handler? There doesn't seem to be a place for the JSP's URL in this element. Second:  it isn't clear to me what the "HTTPServletRequest attributes" are.  Is this a reference to the 
attributes mentioned later?  (forceAuthn, IsPassive, authnMethod, relyingParty). This seems likely as the interface document mentioned: 

http://shibboleth.internet2.edu/javadocs/2.1.3/apidocs/edu/internet2/middleware/shibboleth/idp/authn/class-use/LoginHandler.html

doesn't mention any available setters for attributes.


4) it seems odd (to me) that there isn't a way for me to tell the IdP whether or not this external authentication process that I have invoked has succeeded or failed. Also, no way to set error indications etc. Have I missed a link to another piece of the IdPAuthExternal puzzle?


Not being able to figure these things out from the documentation makes me very uncertain about my ability to integrate an external service with this IdP. If you could let me know where I've missed out on any required reading I would greatly appreciate a pointer to the right stuff.

Finally,  thanks very much to you (Scott and Peter) for taking the time to respond to my question.

Best regards,

martin pardee
 


 
 
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Monday, May 07, 2012 11:30 AM
To: users at shibboleth.net
Subject: Re: newbie question.

* PARDEE, MARTIN  (MARTIN) <mlp at research.att.com> [2012-05-07 17:12]:
> I would like to extend this setup so that my IdP uses an external
> authentication service instead of LDAP. I have a "real"
> authentication service , but rather than go for the highest level of
> complexity at first, I'd just like to have my external auth service
> do something like look up the Userid in a flat file, and return an
> Authenticated/Not Authenticated indication based on that lookup.

As far as (communication with) the IdP is concerned that amounts to
the same thing (i.e., it's not in any way simpler than the "highest
level of conplexity").
The only thing simpler is using an authentication system the IdP
supports directly, but a. you've already done that (LDAP via JAAS) and
b. you specifically want to integrate with an external system of
unkown design.

> Can someone point me to a simple example of this kind of
> customization, or, could someone suggest an article, blog, or web
> page that would help me understand the overall mechanics of this
> problem?  I have read about Login Handlers, IdPAuthExternal,
> etc. but so far the big picture of what I am doing here has not yet
> come into focus.

I don't think there's a shortcut to reading the existing documention
and asking specific questions about it. Same as with most open source
projects (unless you want to hunt down gazillion misinformed and now
outdated blog entries).
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net