Possible to run an IdP from /etc/passwd or NIS?

[Cantor, Scott]

On 3/7/14, 3:36 PM, "Phil Gold" <phil at cs.jhu.edu> wrote:
>
>I'm trying to use the UsernamePassword LoginHandler, but I haven't had
>much luck.  It seems that the JAAS UnixLoginModule doesn't actually do any
>authentication, so it lets literally anything in.

That seems hard to believe, there must be something wrong with the options.

The Java code is all open source now, but I don't know if that's open or
not. The Kerberos module is, so if that one is, you might just take a look
at the code.

>Am I using JndiLoginModule correctly?  Is there a different JAAS module
>that would work better?  Is there a different LoginHandler I should be
>using?

That's really totally out of scope of anything we support, so it really
depends if somebody's used them or not. You probably should try the Tomcat
list, perhaps, or even Oracle's Java forums. The IdP only knows about JAAS.

You could certainly consider Apache in front and using that, which I
imagine can handle NIS directly.

>(While I'm at it, is there a way to get Unix account information into SAML
>attributes?  I'd really like to have group membership available and the
>GECOS information would be nice, too.)

Certainly nothing out of the box. If there are Java APIs for getting it,
that could be scripted or coded, but regardless, it's writing code. If
Java can't get at it, then you'd have to build something more complex to
do it. Bottom line, there's nothing in the code base to do it.

-- Scott