OpenID authentication context

[Russell Beall]

Most of the SPs that will end up using this will be dual-purpose.  The normal login flow will show a discovery service the allows for InCommon federated login, a USC-specific shibboleth account login, or an OpenID login.  Because of this discovery-service-based selection, it would be the SP that indicates what authentication method is used.  Since we won't have the SP use OpenID directly, then the SP has to indicate whether it should use an in-house account, or an OpenID account.

We could also trigger the login using a different application entityID and link that entityID to a different Authentication method in the IdP relying party requirements.  It is nice that the software is so flexible to allow so many different options.

Regards,
Russ.

On May 30, 2012, at 1:52 PM, Chad La Joie wrote:

> On Wed, May 30, 2012 at 4:44 PM, Russell Beall <beall at usc.edu> wrote:
>> I wouldn't mind selecting the authentication method at the IdP and having the SP configuration remain unchanged.  Is it possible to have an SP initiate a normal request that ends up at the login.jsp form, but then I have a "Login with OpenID" button that then has the IdP switch to RemoteUser-based authentication?
> 
> As with pretty much anything in this area, the answer is "yes, if you
> write the plugin that does that".  I'd have to look, but in this case
> I *think* you might be able to do it without writing any custom code.
> I think you can just have a button that redirects from the login.jsp
> to the remote user protected URL.
> 
>> It is likely we will stick to the model of having the SP request the authentication type, because OpenID authentication will only be offered for select SPs and we wouldn't want to confuse the entire campus population with a "Login with OpenID" button on the main page.
> 
> If the SP doesn't make a specific request, you can always control that
> on the IdP side.  Just set the default authentication method for the
> SP.  Whether it's less confusing for you to do that or to get the SP
> to change its config is really going to be situational, as you know.
> 
> -- 
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net