newbie question.

[Peter Schober]

* PARDEE, MARTIN  (MARTIN) <mlp at research.att.com> [2012-05-07 18:43]:
> The user filter was specified as "uid={0}", which, without any
> further info I Assume to mean will get a user ID from an incoming
> SAML request somehow.

Whatever is passed to the IdP as username (e.g. by means of the
provided LoginHandler and an HTML form) is then used in that filter
for an LDAP bind.

> 1) how does ldap tell the IdP if a login attempt fails? I don't see
> the details of the conversation between the external authenticator
> and shibboleth in any of the documentation pages I've read. The
> details of the exchange appear to be hidden from me (this is a good
> news/bad news proposition).

I suppose the Java library it uses (vt-ldap) interprets the
RFC-defined result codes for LDAP protocol messages,
cf. http://tools.ietf.org/html/rfc4511#section-4.1.9
(0 for success, 49 for failed authN, etc.)

> 2) even though I've managed to make the SP "protect" a resource on
> my IIS7 server, the documentation tells me that the entityID I enter
> in the shibboleth2.xml file is just an identifier, not a real URL.
> So I don't fully understand how to tell the SP that I want "this
> particular jsp" or "all of the jsp's in this folder" to be protected
> by my authenticator.

The entityId and authorization(protecting content at the SP are not
related. Have alook at
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
E.g. for the Apache httpd web server (you didn't mention what you're
using) there are native commands to use in httpd config files:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess

> 3) by extension: in trying to understand how to use the handler.xml
> file to use an external authentication mechanism via the
> LoginHandler element,

I'll leave that to others for the momment.

> 4) it seems odd (to me) that there isn't a way for me to tell the
> IdP whether or not this external authentication process that I have
> invoked has succeeded or failed. Also, no way to set error
> indications etc. Have I missed a link to another piece of the
> IdPAuthExternal puzzle?

I think control from your authentication system only returns to the
IdP if authentication failes. I least with traditional HTTP user
agents I wouldn't want to get back to the IdP with some error code if
I mistyped my password, I would want the authentication system to tell
me about the error so I could retry.
If your client is not a human interacting with a webbrowser then
things might be different, but you certainly didn't mention any of
this, so far.

You could start by explaining what your external authentication system
is and what interfaces it provides (or you intend to create for it).
Scott already mentioned fronting the IdP with "something" that
authenticates principals. e.g. Apache httpd with mod_$foo so if
there's an httpd module for your authentication system that's all you
needed, together with the RemoteUser Login handler.
Otherwise something completely different might be warranted, but so
far we can only speculate and point at the docs.
cheers,
-peter