external authentication -shib IdP tutorial and config and working mode

[C G]

Scott,

Thanks. Appreciate the pointers. 

Please bear with me on this as 'am slowly catching up.

First, its very encouraging to know that with external auth handler, 'dont have to touch any
of the Shib (except config files) so 'dont break anything (functionality).

Thanks for the Java docs, very helpful. 

Now coming to my situation, this is what 'see (hope this helps some future newbies too :)
Appreciate if any can confirm the flow (seq of steps)

1. Step one: configure the handler.xml so that URI to EA is setup.
<ph:LoginHandler xsi:type="ph:ExternalAuthn"
                 externalAuthnPath="/authn/external"
                 supportsForcedAuthentication="true" >
    <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:_What_should_go_here_</ph:AuthenticationMethod>
</ph:LoginHandler> 

Since 'am using external auth, what class should go in the above?  I am _not_ using user-passwords here.
what is the significance of the authenticationmethod field here?

2. Add the shibboleth-identityprovider.jar to the EA and have the function/action
 edu.internet2.middleware.shibboleth.idp.authn.
AuthenticationEngine#returnToAuthenticationEngine(HttpServletRequest,HttpServletResponse);
after user authenticates or fails.

 
3. When EA is invoked :
 3a: set session/request attribute:    PRINCIPAL_KEY to user_id (at the minimum)
                                                 AUTHENTICATION_METHOD_KEY : to the URI of EA
                                                 AUTHENTICATION_INSTANT_KEY   to current timestamp if successful or 

                                                                                                 -1 if authentication fails?
                                                 
                                                 AUTHENTICATION_ERROR_KEY :  to any error if auth. fails?
                                                 SUBJECT_KEY               :  ???
and call returnToAuthenticationEngine(HttpServletRequest,HttpServletResponse);

Not sure of subject_key, appreciate if any one can give me an example of a basic case to fill in/bind
those attributes.   [basic case: say 'have user-id, name, possibly email addr of the principal and nothing else]

Here, if auth fails at EA, should the EA set error_key and leave everything else?

Thanks again, 'am almost getting up to speed here.

best regards





________________________________
 
On 9/22/12 11:41 AM, "C G" <[hidden email]> wrote: 
> 
> 
>However, it is not clear what session variables need to be set by the 
>Ext auth to indicate whether auth failed or succeeded? 

"Once completed, the custom-developed code must then set the 
HttpServletRequest attributes required by the 
edu.internet2.middleware.shibboleth.idp.authn.LoginHandler interface and 
invoke 
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine#returnTo 
AuthenticationEngine(HttpServletRequest,HttpServletResponse." 


Did you refer to the documentation for that interface? 

https://build.shibboleth.net/nexus/service/local/repositories/releases/arch
ive/edu/internet2/middleware/shibboleth-identityprovider/2.3.8/shibboleth-i 
dentityprovider-2.3.8-javadoc.jar/!/index.html 

There are also multiple examples in the source or in the contrbutions page 
to look at that interact with the engine. 

>And what is the lib (jar) that includes this api/func rettoautheng 
> that 'need to drop in EA web app? 

shibboleth-identityprovider 


>c) Pls confirm that in this sceneario, no code is needed to be tweaked in 
>Shib Idp? 
>Just only the config xml files? 

And adding your custom files to the container in the same or other 
context, since I think that's the only way you can pick up the session 
attributes set by the ExternalAuth handler. It says they're attributes, 
not parameters, so that means that URL is something in the container. 

-- Scott 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120923/625553ba/attachment-0001.html