newbie question.

[PARDEE, MARTIN (MARTIN)]

Thanks Scott,  that helps a lot.  I'll keep reading.


Martin


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, May 07, 2012 3:53 PM
To: Shib Users
Subject: Re: newbie question.

On 5/7/12 2:57 PM, "PARDEE, MARTIN  (MARTIN)" <mlp at research.att.com> wrote:
>
>But, at the top of this page,  in the section entitled "How It Works", it
>isn't clear whether or not the custom JSP is to just Pass on the Request
>and Response objects it received from the IdP, unmodified, or if fields
>in either of those objects need to be modified. In other words,  my JSP
>receives a request, then invokes a custom authenticator, and then invokes
>the:
>
>Edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine#returnT
>oAuthenticationEngine(HttpServletRequest, HttpServletRespoonse)
>
>But (in my mind) there is a missing piece of "telling the AuthEngine what
>happened during the conversation with the Authenticator.

You pass that back from the JSP in predefined servlet attributes that
identify the principal authenticated, the authentication method
(correlating back to the value the SP requested, if any, or one that is
defaulted), the time of authentication, and/or exception information if an
error occurred.

I assume all that is documented in the Javadocs for the authn engine. I
found it in the code when I built my custom handler, but for people in
your position, reading the code shouldn't be a requirement, so the
integration should be described in the API doc.

There's also a regression in the latest IdP that reintroduced a bug in the
authn engine and it doesn't handle exceptions back from the login handler
properly. Most handlers tend to trap the user with some UI describing the
error and never return back to the engine on failure.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net