How deep is the IdPAuthExternal hole?

[snekse]

So I've started trying to implement external authentication for the IdP.

So far I've:

   - Created a class that implements LoginHandler
   - Ensured my class sets the PRINCIPAL_NAME_KEY
   & AUTHENTICATION_METHOD_KEY attributes on the request
   - Ensure I call AuthenticationEngine.returnToAuthenticationEngine as the
   last thing in processing
   - Added my handler to handler.xml
   - Packaged my Impl in a jar and added to the idp.war
   - Update the web.xml in idp.war to register my servlet and bind to a URL
   and updated idp.war


After doing all that, I of course got a Tomcat error stating my class
couldn't be cast as a Servlet (my bad - the docs say Filter, Servlet or JSP
page).

Looking at Remote User as my baseline, I now see:

   - RemoteUserAuthServlet
   - RemoteUserLoginHandler
   - RemoteUserLoginHandlerBeanDefinitionParser
   - RemoteUserLoginHandlerFactoryBean

I'm just wondering if every Login Handler impl needs all of these as a
hazard of using Spring, or if I'm over complicating things.

If the answer is yes, what else do I need that I'm missing?  Spring XML
config file?

If it matters....

HANDLER.XML
    <ph:LoginHandler xsi:type="ph:ExternalAuthn"
                     externalAuthnPath="/authn/external/SHSession"
                     supportsForcedAuthentication="false"
                     supportsPassiveAuthentication="false"
                     authenticationDuration="30">

 <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
        <!-- <ph:QueryParam name="foo" value="bar" /> -->
    </ph:LoginHandler>


WEB.XML
    <servlet>
        <servlet-name>SHSessionKeyLoginHandler</servlet-name>
        <servlet-class>

com.example.sso.saml.shibboleth.idp.authn.provider.SHSessionKeyLoginHandler
         </servlet-class>
        <load-on-startup>4</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>SHSessionKeyLoginHandler</servlet-name>
        <url-pattern>/authn/external/SHSession</url-pattern>
    </servlet-mapping>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140728/b3b45025/attachment.html