Question concerning Authentication Method

[Cantor, Scott]

On 7/8/14, 4:54 PM, "Brewer, Edward L" <lee.brewer at Vanderbilt.Edu> wrote:
>
>Thanks again.  Actually I am using external authentication on one of the
>IdPs now.

Yes, but what I'm talking about is doing a totally different piece of code
behind that interface that subsumes both of the things you're doing now,
but with the added intelligence of using the SP identity to decide which
to do.

That, or something similar, is the only way you can do this without
forking the method string. Or of course by keeping the IdPs separate.

> The other we call the Guest IdP.  It is configured to use an external
>login handler which is custom code (java servlet) that performs OAUTH
>(Facebook and Google) as well it allows LDAP authentication against an
>LDAP just for Guest accounts.   Both work fine.  I just want to merge
>them into one IdP.

In practice, I wouldn't advise that anyway. You really have two IdPs and
probably should just run them as two. The point of federation isn't to
collapse every authentication option into one IdP, it's the opposite. One
reason people insist on trying to collapse them of course is avoiding
discovery, but since you seem to be implying the there's a specific SP
that would be asking for the alternate mechanism, you could simply have
that SP point directly to the other IdP.

>  In the handler.xml of both I have them set as
>PasswordProtectedTransport for auth method.  I was looking at a way to
>have the new single IdP choose the correct login handler for our users.

I am merely guessing at what you mean by that. What is the information by
which anything would or could make that choice?

>  When I initially looked at the specifications for what I can place in
>the authentication method only unspecified was a close match...

There won't be a match. You will have to make up values.

> because the login handler is actually PasswordProtectedTransport.  So,
>if I were to say chose password instead of passwordprotectedtransport
>(although it really uses https) would it work (provided the application
>owner would accept that in the SAML response).

Yes, it would work.

-- Scott