How deep is the IdPAuthExternal hole?

[Christopher Bongaarts]

On 7/28/2014 4:53 PM, snekse wrote:
> So I've started trying to implement external authentication for the IdP.

I'm assuming you mean "write a custom LoginHandler" as opposed to 
implementing <LoginHandler xsi:type="ExternalAuthn">.

> Looking at Remote User as my baseline, I now see:
>
>   * RemoteUserAuthServlet
>   * RemoteUserLoginHandler
>   * RemoteUserLoginHandlerBeanDefinitionParser
>   * RemoteUserLoginHandlerFactoryBean
>
> I'm just wondering if every Login Handler impl needs all of these as a 
> hazard of using Spring, or if I'm over complicating things.

Short answer is - all but the first are essentially required; the first 
is not, but is common.  This wiki page might be helpful in understanding 
those pieces:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPDevExtLoginHandler

You can compare the other LoginHandlers in the IdP source and the 
Contributions page to see some other patterns (e.g. the X.509 cert auth 
handler is a little bit different).

FWIW, our custom LoginHandler has a LoginHandler and AuthServlet (the 
latter of which is actually called from a pair of JSPs, one that handles 
username/password and one that handles the Duo second factor when needed.)

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140728/abb2ba45/attachment-0001.html