external authentication -shib IdP tutorial and config and working mode

[C G]

Thanks Peter,

Appreciate if my understanding is consolidated with following clarifications:

a) As I see, the ext. auth is called from login-handler provided by shib idp package
and the external auth (EA) address is provided in the login-handler.xml (?)

b) As I see when the Ext auth finishes auth, it should call the 

edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine#
returnToAuthenticationEngine(HttpServletRequest,HttpServletResponse);

However, it is not clear what session variables need to be set by the 
Ext auth to indicate whether auth failed or succeeded? or is there another
way to pass this info?

And what is the lib (jar) that includes this api/func rettoautheng
 that 'need to drop in EA web app?

Pls note EA is pure web app and does not do any SAML (and thats the reason why we are
looking at Shib IDP)

c) Pls confirm that in this sceneario, no code is needed to be tweaked in Shib Idp?
Just only the config xml files?

Thanks in advance




List: shibboleth-users Subject: Re: external authentication -shib IdP tutorial and config and working mode From: Peter Schober <peter.schober () univie ! ac ! at> Date: 2012-09-22 12:10:17 Message-ID: 20120922121017.GS22235 () aco ! net [Download message RAW] * C G <ci_98yr at yahoo.com> [2012-09-22 10:30]:
> 1. What are the files that need to be tweaked, if any, in Shib IdP packag=
e?
> = > 2. What data goes between the external auth system and Shib? Specifically= my situation is
> =A0=A0=A0 a) external Auth (EA) system needs only user-id and is self con=
tained in all aspects. It can authenticate
> the user and redirect back the session to Shib. What parameters or http s=
ession variables if any need to be set?
> Yes, both ways, incoming session from Shib to EA and from EA to Shib?
> = > 3. Any java class tweaking is needed to convey the auth results? The EA c=
an set or pass results?
> BTW, EA has its own API jars that can be dropped in Shib to parse result =
data (not saml, but prop)
> = > 4. In this scenerio, I dont need Ldap, what are the things 'can get rid o=
f in config?
> = > Any step by step documentation on this is highly appreciated with
> thanks! Try this one: https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthExternal -peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120922/bb27c463/attachment.html