newbie question.

[PARDEE, MARTIN (MARTIN)]

Peter (and Scott et al), 

Thanks for the pointers. 

So, between this and other responses,  here's what I've got:

I'm going to go to handler.xml and create a <LoginHandler> element that describes these:

!) externalAuthnPath (the path to my login jsp that will invoke my external service.
by the way,  I'm using tomcat for the idp on Centos,  my SP is running on windows7. My external auth service is an Out-Of-Band authenticator using biometrics to make the final determination of identity. It answers requests on a restful interface. It will be the job of the JSP identified by the <LoginHandler/> element to act as the interface to this stuff and interpret the result).

2) supportsForcedAuthentication
3) supportsPassiveAuthentication
4) authenticationDuration

All this is contained in the IdPAuthExternal wiki page.  (I missed the detail in the example about how to define the URL for the custom JSP.)

But, at the top of this page,  in the section entitled "How It Works", it isn't clear whether or not the custom JSP is to just
Pass on the Request and Response objects it received from the IdP, unmodified, or if fields in either of those objects need to be modified. In other words,  my JSP receives a request, then invokes a custom authenticator, and then invokes the:

Edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine#returnToAuthenticationEngine(HttpServletRequest, HttpServletRespoonse)

But (in my mind) there is a missing piece of "telling the AuthEngine what happened during the conversation with the Authenticator.

Does this make sense?

I'm not sure if I'm making myself clear, because everyone is pointing me back to wiki pages I've already read (admittedly, not perfectly).

While I'm sure that the fine document has almost everything I need ( I can't find a page devoted to the LoginHandler element) I am currently feeling that I am looking at a leg, a tusk or a trunk without seeing the whole elephant.

(sorry to be so dense).


Martin



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Monday, May 07, 2012 1:08 PM
To: users at shibboleth.net
Subject: Re: newbie question.

* PARDEE, MARTIN  (MARTIN) <mlp at research.att.com> [2012-05-07 18:43]:
> The user filter was specified as "uid={0}", which, without any
> further info I Assume to mean will get a user ID from an incoming
> SAML request somehow.

Whatever is passed to the IdP as username (e.g. by means of the
provided LoginHandler and an HTML form) is then used in that filter
for an LDAP bind.

> 1) how does ldap tell the IdP if a login attempt fails? I don't see
> the details of the conversation between the external authenticator
> and shibboleth in any of the documentation pages I've read. The
> details of the exchange appear to be hidden from me (this is a good
> news/bad news proposition).

I suppose the Java library it uses (vt-ldap) interprets the
RFC-defined result codes for LDAP protocol messages,
cf. http://tools.ietf.org/html/rfc4511#section-4.1.9
(0 for success, 49 for failed authN, etc.)

> 2) even though I've managed to make the SP "protect" a resource on
> my IIS7 server, the documentation tells me that the entityID I enter
> in the shibboleth2.xml file is just an identifier, not a real URL.
> So I don't fully understand how to tell the SP that I want "this
> particular jsp" or "all of the jsp's in this folder" to be protected
> by my authenticator.

The entityId and authorization(protecting content at the SP are not
related. Have alook at
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPProtectContent
E.g. for the Apache httpd web server (you didn't mention what you're
using) there are native commands to use in httpd config files:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess

> 3) by extension: in trying to understand how to use the handler.xml
> file to use an external authentication mechanism via the
> LoginHandler element,

I'll leave that to others for the momment.

> 4) it seems odd (to me) that there isn't a way for me to tell the
> IdP whether or not this external authentication process that I have
> invoked has succeeded or failed. Also, no way to set error
> indications etc. Have I missed a link to another piece of the
> IdPAuthExternal puzzle?

I think control from your authentication system only returns to the
IdP if authentication failes. I least with traditional HTTP user
agents I wouldn't want to get back to the IdP with some error code if
I mistyped my password, I would want the authentication system to tell
me about the error so I could retry.
If your client is not a human interacting with a webbrowser then
things might be different, but you certainly didn't mention any of
this, so far.

You could start by explaining what your external authentication system
is and what interfaces it provides (or you intend to create for it).
Scott already mentioned fronting the IdP with "something" that
authenticates principals. e.g. Apache httpd with mod_$foo so if
there's an httpd module for your authentication system that's all you
needed, together with the RemoteUser Login handler.
Otherwise something completely different might be warranted, but so
far we can only speculate and point at the docs.
cheers,
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net