OpenID authentication context

[Cantor, Scott]

On 5/30/12 4:44 PM, "Russell Beall" <beall at usc.edu> wrote:

>I wouldn't mind selecting the authentication method at the IdP and having
>the SP configuration remain unchanged.  Is it possible to have an SP
>initiate a normal request that ends up at the login.jsp form, but then I
>have a "Login with OpenID" button that then has the IdP switch to
>RemoteUser-based authentication?

Anything's possible if you create a custom handler, but once you're trying
to let the IdP drive handler selection, you're locked into that machinery
and you can't really get back out. That's why V3 is very different in this
area, and why I wrote something sort of like it as a custom module, I knew
that I would eventually need control.

>I see that the SP could tell what authentication type was used by the
>Shib_Authentication_Method header.

That's the same field you started asking about. If you wanted to use that,
you'd be able to do what you suggested. I'm saying that if you hide the
real auth method behind "OpenID", you've hidden it and lost information.
Maybe you want Google's extra factor method to be more valuable than
passwords, for example.

>It is likely we will stick to the model of having the SP request the
>authentication type, because OpenID authentication will only be offered
>for select SPs and we wouldn't want to confuse the entire campus
>population with a "Login with OpenID" button on the main page.

No, certainly not. You can also do that by customizing the page based on
the SP. The difference is whether you need to require IdP admin time to
add new SPs, but it seems like this is the kind of thing people seem to
want a lot of policy control around anyway. Some people anyway.

Of course, if your login page is a JSP, it's not really viable, I agree. I
use Velocity and don't need to take down the IdP to change my page.

-- Scott