OpenID authentication context

[Chad La Joie]

On Wed, May 30, 2012 at 4:44 PM, Russell Beall <beall at usc.edu> wrote:
> I wouldn't mind selecting the authentication method at the IdP and having the SP configuration remain unchanged.  Is it possible to have an SP initiate a normal request that ends up at the login.jsp form, but then I have a "Login with OpenID" button that then has the IdP switch to RemoteUser-based authentication?

As with pretty much anything in this area, the answer is "yes, if you
write the plugin that does that".  I'd have to look, but in this case
I *think* you might be able to do it without writing any custom code.
I think you can just have a button that redirects from the login.jsp
to the remote user protected URL.

> It is likely we will stick to the model of having the SP request the authentication type, because OpenID authentication will only be offered for select SPs and we wouldn't want to confuse the entire campus population with a "Login with OpenID" button on the main page.

If the SP doesn't make a specific request, you can always control that
on the IdP side.  Just set the default authentication method for the
SP.  Whether it's less confusing for you to do that or to get the SP
to change its config is really going to be situational, as you know.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered