external authentication -shib IdP tutorial and config and working mode

[Cantor, Scott]

On 9/23/12 7:15 AM, "C G" <ci_98yr at yahoo.com> wrote:
>
>Now coming to my situation, this is what 'see (hope this helps some
>future newbies too :)
>Appreciate if any can confirm the flow (seq of steps)

I have no experience with what you're doing, so I have very little I can
say other than guesses. Somebody who's used the handler is a much better
source of information, if anybody has.

>1. Step one: configure the handler.xml so that URI to EA is setup.
><ph:LoginHandler
>xsi:type="ph:ExternalAuthn"
>                 externalAuthnPath="/authn/external"
>                 supportsForcedAuthentication="true"
>>
>    
><ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:_What_shou
>ld_go_here_</ph:

Nothing, because you cannot make up URNs in a namespace you don't control.
If you can't use an existing class, then you need to make up your own.

>Since 'am using external auth, what class should go in the above?  I am
>_not_ using user-passwords here.
>what is the significance of the authenticationmethod field here?

The associated authn context values that the handler will support if an SP
requests them.

>2. Add the shibboleth-identityprovider.jar to the EA and have the
>function/action
> edu.internet2.middleware.shibboleth.idp.authn.
>AuthenticationEngine#returnToAuthenticationEngine(HttpServletRequest,HttpS
>ervletResponse);
>after user authenticates or fails.

I don't think so. I think you're meant to add your own Java material to
the IdP warfile to be the bridge between your mechanism and the IdP and
then have that layer execute the return to the engine.

-- Scott