ExternalAuth

[Nate Klingenstein]

Nick,

I can't answer this one for certain but I believe ExternalAuth implies that the external authentication system has to be part of the same web environment as the IdP rather than requiring that it run in the same container(e.g. Apache -> AJP -> Tomcat, with the authentication mechanism sitting in Apache).  This is true of at least REMOTE_USER based login.

Anything that involves one system making authentication queries out to an entirely separate system is basically building a custom SSO protocol with all the security that must come with it.  That can be done, of course, but it's easy to make implementation mistakes that become security vulnerabilities, and it's not something that Extternal Auth was trying to achieve with its much simpler set of parameters.

Hope I got it right,
Nate.

On Dec 23, 2013, at 4:02 PM, Nick Amon <namon at xceedium.com<mailto:namon at xceedium.com>>
 wrote:

I would like to integrate Shibboleth 2.4 with the authentication engine of our existing application.  I have determined from the documentation that this is doable with the ExternalAuthn LoginHandler but it appears that the external authentication system must  be Java based (i.e. a servlet) and that it is running in the same container.  Our authentication engine is running in Apache has a PHP application.  Would I still be able to use the ExternAuthn handler to forward authentication requests to it?  How would I return control pack to the AuthEngine, by redirecting the user back to the AuthEngine URL along w/ the required authentication result parameters?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131224/0a0362e9/attachment.html