Question concerning Authentication Method

[Cantor, Scott]

On 7/8/14, 4:11 PM, "Brewer, Edward L" <lee.brewer at Vanderbilt.Edu> wrote:

>Scott,
>
>My confusion lies in the statement where you stated that I need to create
>a custom login handler.

If you need anything remotely interesting or complex, you need a custom
handler. That's just pretty much the way it is. Selecting a method based
on anything other than AuthnContextClassRef qualifies as interesting or
complex.

You can create any context class URI you like and use that of course, but
you asked specifically if you can do it with a single one, or by using
"unspecified".

>I was under the assumption that the authn engine makes the decision to
>pass control over to the appropriate login handler.

Yes, based 100% on a class ref from the SP or on the
defaultAuthenticationMethod in the relying-party definition and on nothing
else. If you use multiple method strings, then you can, mostly, do it with
the system already. If not, you can't do it without writing code.

>If I were to create new login handler wouldn't it still be (since that is
>how it works ) a passwordprotectedtransport auth method and I would be
>back to square one?

No, because that handler is Java code, so you can make it do anything you
want to dispatch the user to whatever logic you care to use. It's an extra
layer of indirection.

-- Scott