Silently try more then one login handler with UnsolicitedSSO

[Henry B. Hotz]

On Apr 29, 2013, at 11:18 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 4/29/13 2:07 PM, "Henry B. Hotz" <hotz at jpl.nasa.gov> wrote:
> 
>> Not true, I gather.  Since I, too, want to accept client cert's as an
>> alternative to Kerberos tickets, should I assume the Kerberos login
>> handler is *not* the way to go.  (Yes, that is a question.)
> 
> I think it's either you write your own by copying bits of others, or push
> this to Apache.

So, I need to test how mod_ssl's FakeBasicAuth option works in conjunction with everything else (or write my own.)

>> So, where should I map X.509 DNs and Kerberos principals to usernames,
>> and how do I create an attribute which says how the original
>> authentication was done?
> 
> The login handler is responsible for deciding what to report as a
> username. If you don't deal with it there, then the rest of the system
> will have to accomodate attribute lookups using all those different
> flavors of identity. I'm not aware of any support for principal mapping
> inside of any existing login handlers, so this isn't done for you, in
> short. Another requirement for a custom handler.

If I can't do it in Kerberos or Apache, then it's custom.  OK.

> Attributes aren't used in most cases to describe authentication, that's
> what AuthnContext is for. That's set based on the authenticationMethod
> string used to dispatch requests to the login handler and returned from
> it. Existing handlers cannot accomodate a single handler returning
> different method types.

Some SPs will want to insist on something better than a password.  If I don't give them an attribute, and the authenticationMethod is always the same, what should I do?  Or is this just another way of saying I need to do something custom?  ;-)

> If you need something fancy, you need to write your own handler. There's
> not much else to be done.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu