Questions starting to implement Shibboleth IDP

[Robert Law]

Okay.  Please ignore my ignorance.  But this is how I think it might work.
1. A user logs into our application that is container managed by tomcat
which can be called app.mysite.com
2. User clicks a link to Salesforce.
3. Salesforce sends an AuthnRequest to Shibboleth which I will call
sso.mysite.com
4. Shibboleth then forwards the browser to the servlet I have setup to
handle external authentication.
5. The external authentication servlet tries to forward to
app.mysite.com/checkforlogin which is protected by container security
6. If the user has logged on the checkforlogin servlet will execute.  It
will return to Shbboleth via the standard way for external authentication
to return.
7. If the user hasn't logged on, container security display a login page to
the user's browser for then to login.  After they login control returns to
the checkforlogin servlet authomatically.  It then returns to Shibboleth
via the standard way.

Does that work or am I off base?  If I'm off base, can you give me any
suggestions.

I really appreciate your help.

On Wed, Dec 31, 2014 at 1:30 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Yes I believe you understand what I'm try to do.  The idea of using an
> > external login handler sounds good.  I thought that the external login
> handler
> > had to be in the same tomcat instance as the IdP.
>
> It does. What it does after that is up to it.
>
> >  They will actually be in
> > different virtual machines.  Doesn't Shibboleth IdP handle session
> > management it or does it call the external login handler every time?
>
> It depends how it's configured.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141231/bbd7eb50/attachment.html