Question concerning Authentication Method

[Brewer, Edward L]

Scott,

Thanks again.  Actually I am using external authentication on one of the IdPs now.  To be more specific, the first IdP is using Username/Password (JAAS) where it is configured to authenticate against two of our LDAP servers.  This IdP performs about 95 percent of the login work, where the LDAPs that it is uses are our institutions main authorization and attribute source.  The other we call the Guest IdP.  It is configured to use an external login handler which is custom code (java servlet) that performs OAUTH (Facebook and Google) as well it allows LDAP authentication against an LDAP just for Guest accounts.   Both work fine.  I just want to merge them into one IdP.  In the handler.xml of both I have them set as PasswordProtectedTransport for auth method.  I was looking at a way to have the new single IdP choose the correct login handler for our users.  My first thought was changing the auth method of the external login handler so that I could make that the default value for the one lone SP (internal application) that uses it.  I also know that the application that uses the guest IdP does not request in the SAML request for a particular Auth method so I had my fingers crossed.  When I initially looked at the specifications for what I can place in the authentication method only unspecified was a close match... because the login handler is actually PasswordProtectedTransport.  So, if I were to say chose password instead of passwordprotectedtransport (although it really uses https) would it work (provided the application owner would accept that in the SAML response).

Thanks again for your time,
Lee Brewer

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, July 08, 2014 3:30 PM
To: Shib Users
Subject: Re: Question concerning Authentication Method

On 7/8/14, 4:18 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>>If I were to create new login handler wouldn't it still be (since that 
>>is how it works ) a passwordprotectedtransport auth method and I would 
>>be back to square one?
>
>No, because that handler is Java code, so you can make it do anything 
>you want to dispatch the user to whatever logic you care to use. It's 
>an extra layer of indirection.

(And I'm not saying this is trivial, I don't think I ever have. I'm just saying it's about all there is if you don't want to fork the method
string.)

Note, I think also you might be able to use an External handler and then build off of that. It has access to the requesting SP inside the servlet you plug in as the external auth path, so that's essentially another way of building a custom handler without as much boilerplate, but it's still Java work.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net