Additional params through ExternalAuthn LoginHandler

[snekse]

I'm afraid to know the answer to this.

I have the following LoginHandler defined:

    <ph:LoginHandler xsi:type="ph:ExternalAuthn"
                     externalAuthnPath="/authn/external/SHSession">

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
    </ph:LoginHandler>

I'm trying to use this in conjunction with the Unsolicited SSO.  My servlet
sitting at "/Authn/external/SHSession" requires a parameter as part of the
request.

I'm kicking off my request process by making a GET request to the following
path (note the 'key' param):

/idp/profile/SAML2/Unsolicited/SSO?providerId=
https://sp.testshib.org/shibboleth-sp&key=88e389d28ec7bce2d7ffda0e3981a7de

My servlet tries to extract the param with the name 'key'.  It's not there
(no params are)

I notice in the idp process logs that it states:
"Redirecting user to authentication engine at
https://idp.machine:443/idp/AuthnEngine"
"Authenticating user with login handler of type
edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler"
"Forwarding authentication request to /authn/external/SHSession"

So my questions...

1. Do I have any options for getting params to my servlet within the
Shibbothleth framework?

2. The redirect to AuthnEngine is making me think the answer to #1 is no.
 If that's the case, any suggestions for hacks?

3. Would using the UsernamePassword handler make this any easier?

4. If the answer is no for all of the above, am I heading down the path of
a custom ... thing?

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPDevCustomExtension
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPDevCustomAuthentication
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPDevExtLoginHandler
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140729/d4df7e5e/attachment.html