Shibboleth IdP v3 beta 1 External Authentication State

[Cantor, Scott]

On 12/18/14, 12:46 AM, "Gary Gwin" <ggwin at cafesoft.com> wrote:



>I'm developing an External Authentication module for third-party SSO. 
>When I need to redirect to the external third-party SSO login page, if I 
>preserve state by adding a "conversation" query parameter to the 
>redirect (to redirect back when login is finished), the module works as 
>desired. Here's pseudo code:
>
>if (authnRequired){
>    final String conv = request.getParameter("conversation");
> 
>response.sendRedirect("https://idp.domain.com/login.jsp&url=https://idp.do
>main.com/idp/Authn/External?conversation=" 
>+ conv);
>    return;
>}
>
>Is this correct use of the API or is there a better way to handle state?

Well, you MUST be able to pass back in the conversation key when you 
invoke the finalize call inside your module, but it's entirely up to you 
how you want to achieve that.

As with any external module, you're taking on a huge security 
responsibility there and you obviously have total ownership of the 
security implications of redirecting to some other system and getting 
control back. That has to be another SSO protocol effectively.

The conversation key itself is really coming from SWF, and it isn't 
strictly speaking something you can just grab and misuse since it's an 
index into container session state. But in general, it would probably be 
better to keep it local and maybe issue a separate state token to use in 
your side of things to get back to it at the end.

-- Scott