Questions starting to implement Shibboleth IDP

[Robert Law]

Yes I believe you understand what I'm try to do.  The idea of using an
external login handler sounds good.  I thought that the external login
handler had to be in the same tomcat instance as the IdP.  They will
actually be in different virtual machines.  Doesn't Shibboleth IdP handle
session management it or does it call the external login handler every time?

On Wed, Dec 31, 2014 at 12:56 PM, Christopher Bongaarts <cab at umn.edu> wrote:

> On 12/31/2014 12:16 PM, Robert Law wrote:
> > Another question.  We have an application that uses tomcat container
> > security, realms, etc.  When a user has logged in to the application
> > they may click a link that takes them to another service provider.
> > That service provider needs to do SSO to the IdP that we will be
> > installing.  Is there anyway for a service provider that supports
> > login to notify the IdP that the user has logged in, or do we need to
> > perform all logging in to use the IdP?
>
> Let me know if this doesn't accurately capture your question.  I think
> you are asking:
>
> "I have an existing local authentication system for a web application.
> That app has a link to another app that will use Shibboleth
> authentication.  I want to do SSO between them; i.e. Shib will respect
> the existing local auth and not ask the user to log in again."
>
> It is possible to do this, but not out of the box.  If you're using an
> external login handler that shares state with the local auth system,
> you're basically done.  Otherwise you'll have to figure out a way to
> connect them yourself.
>
> When we first set up Shib on our campus, we used a custom login handler
> that used a shared domain cookie to allow Shib to handle SSO with our
> existing campus SSO system (which worked a lot like pubcookie).
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141231/45a4368e/attachment.html