Doubt about kerberos login handler

[Douglas E. Engert]

On 1/21/2014 3:50 PM, david.tello at wbsgo.com wrote:
> Hi all,
>
> I have a doubt about the kerberos login handler.  I have now a IDP that
> makes login correctly with kerberos, but i want to have a mixed
> solution. I want to have a login jsp that allow have kerberos login (i
> have this one currently), and allow login with user/password in a LDAP
> (not Active Directory) too. I don't know if it's posible.
> If it's posible, can someone said me how? in a few words, i will search
> with thats.
>
> Thanks a lot of for your time.

Yes we do it too. To make in more friendly, it requires some changes to
the user/password login JSP to call the kerberos-login.jsp  and changes to
the java-idp-kerberos-login-handler to not flush the request, and changes to
the kerberos-login.inc.jsp to catch errors if kerberos fails to fall back to
the login user/paswsword logon page.

We use AD, so I am not sure if that is an issue for you.
The user/password login and kerberos login handlers both set requestContext.principalName
but Kerberos sets the value to  the kerberos principal which includes realm.

You can use this to determine if it was user/password or kerberos
and select different DataConnector if needed.

.



>
> --
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov> <DEEngert at gmail.com>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444