Shibboleth Login Handler questions [SEC=UNCLASSIFIED]

[Peter Schober]

* BONNY, Michael <Michael.Bonny at fahcsia.gov.au> [2013-07-09 08:38]:
> 1) Can I implement a Kerberos/SPNEGO Login Handler to Single Sign On the users?
> All of the examples I can find are all based around Linux/Apache. I
> thought that this would be easier with IIS on Windows using a domain
> joined server.

https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler

I don't think it matters much which OS the JVM runs on.

> 2) Can I implement an Other-IDP Login Handler, so that users can be
> authenticated by an alternate IDP?
> The end user would get the following experience:
> Navigate to shibsite1.mydomain.com (get redirected to shibidp.mydomain.com)
> Shibidp.mydomain.com would then detect the user was dev-internal,
> and redirect them to another IDP (devshibidp.mydomain.dev)

You could use the RemoteUser Login Handler for that, together with a
Shibboleth SP requiring sessions at a different SAML IdP.
-peter