External Authentication setup issues.

[PARDEE, MARTIN (MARTIN)]

Peter,

I appreciate the pointer,  but am not sure how to interpret your comment.  I've seen this commented out section before.  Are you saying that I need to uncomment this and use it to "specify" the new (let's call it "Telephony" ) authentication method,  like this?  :

   <ph:LoginHandler xsi:type="ph:ExternalAuthn">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony</ph:AuthenticationMethod>
        <ph:QueryParam name="foo" value="bar" />
    </ph:LoginHandler>


That actually makes sense to me.  It looks like the "missing link" I've been searching for. Thanks!

SO., it looks like I could SKIP all of the web.xml changes,  and just modify the handler.xml,  with this new change, and expect to see some action in my new Auth Invoker class. Whoopee!  I'm going to give this a try right now.


(Happy happy joy joy)

Martin
:)





-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, May 16, 2012 11:42 AM
To: users at shibboleth.net
Subject: Re: External Authentication setup issues.

* PARDEE, MARTIN  (MARTIN) <mlp at research.att.com> [2012-05-16 17:22]:
> It seems to me that web.xml is where I need to go to plug in my
> custom "authenticator-invoker" class.  It also seems that
> handler.xml is where I need to tell the IdP that there is a URL to
> use for an operation of type "ExternalAuthn". But I don't see a
> place where I can tell the IdP that an incoming request from a given
> SP should _use_ this new type of authn to resolve the user's
> identity.

The default handler.xml from a current IdP (2.3.6) contains this as an
XML comment:

    <!-- Login handler that delegates the act of authentication to an external system. --> 
    <!-- This login handler and the RemoteUser login handler will be merged in the next major release. -->
    <!--
    <ph:LoginHandler xsi:type="ph:ExternalAuthn">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
        <ph:QueryParam name="foo" value="bar" />
    </ph:LoginHandler>
    -->

-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net