different authentication page

[Michael A Grady]

On Dec 4, 2014, at 3:44 PM, Andrew Morgan <morgan at orst.edu> wrote:

> nossair,
> 
> When you use CAS with Shibboleth using the RemoteUser handler, there is no 
> opportunity to change the CAS Service URL that is passed to CAS.  The CAS 
> Service URL will always be the Shibboleth URL 
> (https://idp.pixid.com/idp/Authn/RemoteUser in your case).
> 
> Sorry, I don't know of a way to accomplish your goal in the case where 
> Shibboleth delegates authentication to CAS via RemoteUser.

I agree that the RemoteUser approach does not support this. On the other hand, if instead of the RemoteUser handler, you use the external authentication handler and the Shibboleth IdP External Authentication via CAS plugin:

  https://github.com/Unicon/shib-cas-authn2

that supports sending additional parameters to the CAS Server, such as the entityID of the requesting service, so that you can then use that info to adjust the login page that CAS presents. It also supports sending along an indicator for forced authentication or passive.

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.