Several Auth Mechanisms and Attribute Release

[Cantor, Scott]

On 8/19/13 8:51 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>> I have a test setup with Shibboleth and have implemented login through
>username/password against AD and also Kerberos against the same AD.
>
>When you say ³Username/Password² do you mean "LDAP via JAAS"? If so, have
>you considered implementing is via KRB5 and JAAS?  That way you
>might/should
>get the correct principal.  I have not tried this for quite some time so
>things may be different, but I am sure that a one stage (which may have
>been
>1.3) KRB/JAAS gave you a "qualified with the domain" principal...

The V2 code returns the first Principal in the Subject as the "principal
name", which is probably somewhat unpredictable. My custom code doesn't
return a Java Subject to the IdP, so I don't know what the vanilla
behavior is anymore.

Anybody relying on that sort of approach probably oughtn't use
request.principalName in the resolver.

-- Scott