Possible to run an IdP from /etc/passwd or NIS?

[Phil Gold]

* Cantor, Scott <cantor.2 at osu.edu> [2014-03-07 21:36 +0000]:
> On 3/7/14, 3:36 PM, "Phil Gold" <phil at cs.jhu.edu> wrote:
> >I've been asked to set up an IdP that uses these NIS accounts for
> >authentication.
> 
> You could certainly consider Apache in front and using that, which I
> imagine can handle NIS directly.

I ended up using mod_authnz_external with a mod_auth_basic frontend on
Apache proxying to Tomcat via AJP.  mod_auth_form looks nice, but I'm
stuck with Apache 2.2 for the moment.

> >(While I'm at it, is there a way to get Unix account information into SAML
> >attributes?  I'd really like to have group membership available and the
> >GECOS information would be nice, too.)
> 
> Certainly nothing out of the box. If there are Java APIs for getting it,
> that could be scripted or coded, but regardless, it's writing code.

I wrote some code.  :)

https://github.com/asciiphil/shib-unix-connector

-- 
Phil Gold / JHU CS IT (Linux)
phil at cs.jhu.edu