more External Authentication setup issues

[Chad La Joie]

The login.jsp isn't used if you're doing external authentication.  The
information that needs to be present on the response object is
documented in the login handler javadoc.

I suspect what is happening is you are confusing yourself by looking at
a bunch of different things and mistaking the stuff that they choose to
do for their particular authentication technology with something that
you /have/ to do for yours.

Also, you don't own the SAML namespace so you can't create URNs from it.

On 5/18/12 12:04 PM, PARDEE, MARTIN (MARTIN) wrote:
> Folks:
> 
>  
> 
> First of all a very big  THANK YOU to Peter Schober and Chad La Joie for
> their invaluable suggestions.  Adding my jar file to the $IDP_HOME/lib
> location, as well as to the war file made a big difference.
> 
>  
> 
> By looking at the user-contributed project for x509 external
> authentication I have progressed to the point where I am both arriving
> at my External Auth servlet,  and getting the following messages in my
> idp-process.log file:
> 
>  
> 
> 11:41:51.900 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514]
> - Completing user authentication process
> 
> 11:41:51.900 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585]
> - Validating authentication was performed successfully
> 
>  
> 
>  
> 
> I am now confused by the behavior of the login.jsp in my idp webapp.
> After a “successful” authentication indication in the idp-process.lig
> file (above)  I wind up on the error.jsp page in the idp project.
> 
>  
> 
> The process flow goes like this:
> 
>  
> 
> Hit the “protected URL”.
> 
> Get to the login page
> 
> Enter a user id and password
> 
> Hit submit
> 
> Logs indicate a successful trip through my external handler servlet and
> successful auth by Auth Engine
> 
> Land on error .jsp page.
> 
> (if I pull down the “recent destinations menu in firefox and re-send to
> the last url, I see the page I originally expected)
> 
>  
> 
>  
> 
> My suspicion is that there is missing information in the request or
> response object from the servlet, before returning control to the
> AuthEngine class.  The “repeat send” behavior suggests that there’s an
> SSO token hanging around for me somewhere.  But examining the processing
> done in the x509 object doesn’t provide me with a clue as to what
> specific field in the Request or Response object needs to be se in order
> to let the Login.jsp page know that the Authentication really took place
> successfully.  I would have guessed that once the Authentication Engine
> is logging a successful auth result, it would have placed an indication
> of that success into the appropriate object. This is probably my lack of
> web application programming knowledge but I’m stumped.
> 
>  
> 
> If anyone has experience with this kind of thing,  I could really use a
> hint.
> 
>  
> 
> Best regards,
> 
>  
> 
> Martin pardee
> 
> mlp at research.att.com <mailto:mlp at research.att.com>
> 
>  
> 
>  
> 
>  
> 
> PS –
> 
>  
> 
> My servlet’s service() method looks like this:
> 
>  
> 
>   protected void service(HttpServletRequest request, HttpServletResponse
> response)
> 
>     throws ServletException, IOException
> 
>   {
> 
>     String username = request.getParameter("j_username");
> 
>     String password = request.getParameter("j_password");
> 
>  
> 
>   
> 
>     if ((username == null) || (password == null)) {
> 
>       redirectToLoginPage(request, response);
> 
>       return;
> 
>     }
> 
>    
> 
>     Subject subject = new Subject();
> 
>  
> 
>     Set<Principal> principals = subject.getPrincipals();
> 
>        
> 
>     // Add the public credentials of the subject
> 
>     Set publicCredentials = subject.getPublicCredentials();
> 
>  
> 
>     request.setAttribute(LoginHandler.SUBJECT_KEY, subject);
> 
>        
> 
>     request.setAttribute(LoginHandler.AUTHENTICATION_METHOD_KEY,
> "urn:oasis:names:tc:SAML:2.0:ac:classes:SAFE");
> 
>       
> 
>      AuthenticationEngine.returnToAuthenticationEngine(request,
> response);  
> 
> }
> 
>  
> 
>  
> 
>        
> 
>  
> 
>  
> 
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net