When does the _idp_authn_lc_key get set with ExternalAuthn?

[Christopher Bongaarts]

On 7/31/2014 1:15 PM, snekse wrote:
> Sorry if these are stupid questions.  I'm blaming it on a less than 
> optimal setup.
>
> 1. When does the  _idp_authn_lc_key cookie normally get set in 
> ExternalAuthn flow if the user needs to login?

Should be fairly early on in the process - the response generated from 
the SSO endpoint, I believe.

> 2. Can I force it to be set before a servlet redirect?

Should already be set by then...

> 3. Is there a way I can utilize Shibboleth to do a redirect instead of 
> a raw servlet sendRedirect?

Shouldn't need to; we use it in our LoginHandler...

> BACKGROUND
> We're doing External Authentication via a servlet.  If the servlet 
> determines that the user is not authenticated and needs to login 
> again, I need to display a login page.  The problem is our login page 
> and logic exist in another application, so I'm trying to re-direct to 
> that applications login page. (Q: "Then how does your servlet know if 
> the user is authenticated?" A: "Dark magic via domain cookies and 
> databases calls")
>
> Here is the flow
>
> www/login
>        [User logs in]
> www/home
>        [User clicks link]
> IdP/unsolicited?providerId=sp.example&relayState=www.example.com/dashboard 
> <http://www.example.com/dashboard>
>        [ IdP eventually redirects to our servlet]
> IdP/authn/external/SHSession (this is our servlet path)
>       [Authn fails, redirect to external app login page] !!! This is 
> where I need  _idp_authn_lc_key cookie set !!!
And it should be...
>       [Note: Currently using req.sendRedirect - is there a better way?]
We use response.sendRedirect ourselves...
> www/login?whenDone=IdP/authn/external/SHSession (Guessing here)
>       [User logs in and is redirected to whenDone]
>       [Note: If needed, whenDone could be orig IdP Unsolicited URL]
Most likely you want to send them back to your servlet (SHSession).
> IdP/authn/external/SHSession
>       [Authentication passes, call returnToAuthenticationEngine]
> IdP/AuthEngine
>      [Eventual return to profile to get relayState]
> ...  [A bunch of redirects later...]
> www.example.com/dashboard <http://www.example.com/dashboard>
>     [User is happy]

This looks pretty reasonable, though I question the ability to make 
users happy consistently.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140731/637045f1/attachment.html