External authentication on a different system than the IdP

[Cantor, Scott]

On 7/24/13 10:59 AM, "Brian Reindel" <brian at reindel.com> wrote:

>Is it possible to have the external authentication live outside the
>context of the IdP? I noticed the externalAuthnPath is context
>relative. Basically we have a login page already configured for our
>external authentication system, but it it isn't on the same server as
>the identity provider. Will this not work given how external
>authentication is configured, or am I misunderstanding the
>capabilities?

Using the external handler means you are responsible for implementing a
SSO protocol that is secure between the servlet path configured into the
handler and anything else it uses. If you want it to go somewhere else,
that's up to you, but there has to be a piece of code running locally or
there would be no way to implement a secure protocol.

-- Scott