Auto-login user programatically?

[Cantor, Scott]

On 7/26/13 4:18 AM, "Byte Flinger" <byteflinger at gmail.com> wrote:

>If I understand what you mean, I'd need to have a SAML Request come in
>first to specify which profile handler to be used which in turn goes to
>the login handler but then my question would be, how does the Unsolicited
>SSO profile works and can I implement a handler in a similar way (So that
>no request is required, the user simply goes to the login page and is
>logged in with a SAML Response sent back)?

The unsolicited handler is the same as the old legacy Shibboleth protocol
request handler, and is nothing more than a proprietary request profile.
It's just another profile handler the IdP supports that doesn't happen to
be standardized.

There is no such thing as "get the IdP to respond without a request". It's
not sentient, and it can't know to respond unless you ask it to. You do
that with a request in a format supported by some profile handler.
Authentication is an internal, automatic mechanism that happens in the
middle after a request is provided and before a response is returned.
That's how it works.

>My guess would be that I need to implement a custom profile handler
>instead of a login handler then (or maybe even both)?

I can't think of any obvious reason why you would do that rather than
simply manufacturing redirects to the unsolicited SSO endpoint.

-- Scott