question about shibboleth and perl script redirection

[Nate Klingenstein]

Joseph,

> Thank you for your response.  Let me try to explain this a little 
> better. My login script is run via the browser.  I have used this script 
> to redirect to cas server with success by passing parameters in the 
> query_string that allowed me to obtain a response from the CAS server in 
> the form of xml document - either success or failure depending upon the 
> user/pass.

Thanks, that's helpful.  Shibboleth supports a wide variety of authentication flows, so you still have some choices to make.

You can start the process either by getting an AuthnRequest from the SP and playing it to the IdP or issuing your own unsolicited SSO response.  This would correspond to the first and second links in my first email.

It's generally considered preferable to acquire an AuthnRequest because it better decouples the SP deployment from the IdP and offers more options to secure the communications.

Authentication will need to be performed in either case.  This could be an HTML form or basic auth or client certs or whatever the IdP has chosen to support.

Following a successful authentication, an assertion will be handed to the client.  Failed authentications result in a method-dependent error case.

A pair of decisions would be, "unsolicited SSO followed by basic auth", which boils down to up to 4 query parameters and the authentication.  I wish I could be more prescriptive, but implementation choices like this are part and parcel of deployment flexibility.

Let us know if we can help further,
Nate.