Can a Service Provider Display the Login Form?

[Peter Schober]

* dave.colwell <dave.colwell at intermedix.com> [2014-03-12 15:08]:
> We currently have many hundreds of customized login pages based on
> customer branding and would like to adapt them to use SAML for SSO
> to other internally hosted products.

You can brand the Shibboleth IDP login page completely based on the
entityID of the SAML SP, today, with the exisring UsernamePassword
login handler.

> Is it possible to allow a service provider to capture a user's
> username and password and make these available to the identity
> provider?

I would strongly recommend against that. Some would consider this
phishing (though it's more credential replay) and many would not use
such an SP. Necessariy the SP would get access to the subject's
password that way, prevention of which is part of the reason to use
SAML.

In theory each SP could co-locate its own ECP client and authenticate
to that SP via your IDP. I guess that's the most support in the
current code you'll find. Doesn't change any of the above, of course.
-peter