External authentication on a different system than the IdP

[Peter Schober]

* Brian Reindel <brian at reindel.com> [2013-07-24 18:03]:
> I guess I'm thinking of it this way:
> 
> 1.) User hits SP protected endpoint.
> 2.) Redirect to IdP.
> 3.) External auth handler takes over.
> 4.) Redirect to external authentication system.
> 5.) External authentication.
> 6.) Redirect back to IdP with success/failure.
> 7.) Redirect to original SP protected endpoint if success.

Something like that, if you mean
4 The ExternalAuth login handler passes control over to /your/
code that runs co-located with the IDP.
5 you do what you want
6 your external authn system passes control back to your code that
runs co-located with the IdP. You pass control back to the IDP.
7 the IdP does its usual business
-peter