Auto-login user programatically?

[Byte Flinger]

Hi David

Yes, although that is not the main issue I believe, if we take an LDAP
server as an example it would be simple to login the user programatically
by calling the Unsolicited SSO with the required parameters. The issue
would be that since the login was done programatically on server side, the
user browser never sets any cookie which, to my understanding, is required
by Shibboleth (Though it may be a misconception on my part and is only
required for the default UserPassword loginhandler).


On 25 July 2013 15:30, David Langenberg <davel at uchicago.edu> wrote:

> Sounds like what you need to do is build a custom LoginHandler that
> handles the user-registration / initial authentication part.
>
> Dave
>
>
> On Thu, Jul 25, 2013 at 7:25 AM, Byte Flinger <byteflinger at gmail.com>wrote:
>
>> Hi
>>
>> I am trying to test the following scenarion:
>>
>> 1 - User fills some information about himself and submits a form
>> 2 - An action is triggered which creates an user on backend server LDAP
>> (on IDP side) and redirect the user back to the SP
>> 3 - Once redirected to the SP, the user will be automatically logged in
>> without having to fill the information he just did.
>>
>> The idea is to trigger a login request to Shibboleth together with the
>> user creation on LDAP by programatically calling Unsolicited SSO with the
>> required information however I am uncertain how to handle the part where
>> the user is automatically logged in once he is redirected to the SP.
>>
>> I could redirect the SAML Response gotten from the login request all the
>> way back to the SP (Via the user browser) however if I understand
>> correctly, once that happens the SP will just redirect to Shibboleth and
>> because the user browser will not have the session cookie set, Shibboleth
>> will once again ask for a login.
>>
>> I am guessing that if the SP uses that SAML Response when redirecting to
>> Shibboleth, Shibboleth will notice the user is already logged in, set the
>> necessary cookies and redirect back to SP, however that sounds like a lot
>> of unnecessary back and forth.
>>
>> Are there any suggestions on a better of going about this? I am guessing
>> the cookie is required for recognizing the user as logged in?
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> David Langenberg
> Identity & Access Management
> The University of Chicago
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130725/f220b7b2/attachment.html