External Authentication setup issues.

[Chad La Joie]

If you're looking to integrate a new authentication mechanism you have
a couple of options.  The easiest, if you can do it, is to have the
container (Apache, Tomcat, Jetty, etc.) do the authentication and set
the REMOTE_USER information.  Then use the REMOTE_USER login handler.

Option two is to use the external authentication handler.  The
external authentication handler hands off control to a URL that you
provide.  What goes on after the handoff occurs is totally up to you
and you can do anything you can program.  When your code is done doing
it's thing it has to pass control back to the IdP per the
documentation.

Option three is to write you own login handler.  This requires the
most effort but allows you the most flexibility.  The documentation of
how to write a login handler is also documented.

Note, none of these options has anything to with the username/password
login handler or JAAS.

On Tue, May 15, 2012 at 5:43 PM, PARDEE, MARTIN  (MARTIN)
<mlp at research.att.com> wrote:
> Folks:
>
>
>
> I’m attempting to use an external auth engine on my idp.  I have a service
> that uses voice to authenticate a user, and it is activate via a call to a
> restful web interface.
>
>
>
> I have followed the instructions found here:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthExternal,
>
>
>
> I have a class, in a jar file, placed in the idp project’s WEB-INF/lib
> directory. This class is patterned after the UserPasswordLoginHandler class
> in order to get the interface to the AuthEngine right..
>
>
>
>
>
> I have modified the idp project’s web.xml file to include a definition for
> the servlet, based on that class.
>
>
>
> I have modified my handler.xml file to use a LoginHandler definition that
> refers to the URL for this servlet.
>
>
>
> When this is all assembled and the servers restarted, I always get to the
> UsernamePassword login (if there’s no active SSO session still in effect).
>
>
>
> I suspect that I need to make some kind of addition or mod to the
> information in the JAAS configuration file, login.config, but the
> instructions on this page don’t suggest that.
>
>
>
> I’ve examined the community-contributed examples for x509 auth and
> multi-factor auth, and there are enough differences between these projects
> and my own, that I get more confused about what is expected. These projects
> delve into modifying the login.config (which is where I got the idea from)
> and the xsd schema.
>
>
>
> Please, I could really use some guidance on what the bare necessities are
> for integrating a new external authentication class into the shibboleth
> frame work are. I am beginning to think that my only recourse is going to be
> downloading the source and hacking it locally.  This seems like an extremely
> bad idea, and I can’t believe that trying to use a published extension is
> really this hard. I MUST be missing something.
>
>
>
>
>
> Thanks for listening to me vent.
>
>
>
>
>
> Martin Pardee
>
>
>
>
>
> mlp at research.att.com
>
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered