Selctive protecting endpoint with Apache/mod_shib

[Nate Klingenstein]

Marek,

You're basically describing a multi-protocol discovery service, which is not something Shibboleth supports.  You can send a user to a discovery service when they attempt to access a Shibboleth-protected URL, or you can explicitly ask Shibboleth to create a user session by redirecting the user to a particular URL, and so forth.

The basic thing you want to build isn't part of what Shibboleth or most anything else does out of the box because there are so many authentication methods and protocols to choose from.  You might find more of the functionality you want in simpleSAMLphp.

Thanks,
Nate.

On Feb 26, 2014, at 7:58 AM, Marek Denis <marek.denis at gmail.com<mailto:marek.denis at gmail.com>>
 wrote:

I was wondering whether there is a possibility to configure Apache in
a manner, where certain url is protected basing on some input a user
sends..or at least certain conditions?
I would like the users to always access one URL - say
https://host/auth/tokens but at the same time be able to choose from
many authn methods (apriori of course). These are: SAML2 based as well
as some internal ones, handled by underlying application (e.g.
login/password pairs). Is there any way to configure Apache and/or
mod_shib so it would not start federated-protocol dance always but
only under some circumstances - certain input sent by the user or a
HTTP variable present in the header?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140226/b80c916b/attachment.html