Custom UserPassword Authentication

[Cantor, Scott]

> Could you please help us? Which is the best approach to use? Should we add
> our userPassword servlet and custom login handler?

You can build a custom login handler, you can build a JAAS login module to handle the password step alone, or you can use a servlet and plug it in with the External login handler.

There is no "best", it depends on your needs and preferences.

If a servlet alone, hosted with the IdP, is sufficient, then it would probably not make much sense to build a full login handler, as the External handler will already transfer control between the IdP and the servlet. But if it were me, I'd see no reason not to do a JAAS module when all I needed was to plug in a different password verification process.

-- Scott